Fehler beim Laden von .dll

xdreamIV · 23.04.2008, 18:18

Vorgeschichte:
Habe mir gestern beim Surfen wohl einen Schädling eingefangen, prompt meldete norton einen Angriff.
Hab dann sofort das System gescannt mit Norton Security und Spybot - Search & Destroy, beide fanden Adware, hab die Dateien dann repariert, bzw. entfernt.

Seit dem zeigt Vista mir jedes mal nach einem neuen Aufstarten die Meldung: "Fehler beim Laden der **.dl, Modul nicht auffindbar" das komische ist, dass die fehlerhafte .dll-Datei jedes mal einen anderen Namen trägt

.

Habe mich schon ziemlich weit in Google erkundigt, hab aber nichts gefunden, das ich eins zu eins auf mein Problem umsetzen könnte, darum hier der Logfile (übrigens mein erster, bin ziemlicher Jungspund und kenn mich mit "hijackthis" nicht so wirklich aus!):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:05:13, on 23.04.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=74&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=74&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: (no name) - {6CB07271-D192-442A-8480-E99102A5C60E} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DelayLoad] C:\Users\Xdream\AppData\Local\Temp\msprint.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: vadokmxt - {CCA2DB67-418F-4AE5-B3BF-E5EE7F53F91A} - C:\Windows\vadokmxt.dll
O21 - SSODL: wdpoefan - {46F5287A-64B9-403E-B563-31EC83B50EA7} - C:\Windows\wdpoefan.dll
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 9701 bytes

cosinus · 23.04.2008, 18:56

Zitat:

Habe mir gestern beim Surfen wohl einen Schädling eingefangen, prompt meldete norton einen Angriff.

Zu ungenau. Mit welchem Browser warst Du auf welcher Seite genau? Was genau hat der Virenscanner gemeldet? "Angriff" ist zu ungenau - poste am besten den genauen Wortlaut der Meldung, am besten Du schaust dazu ins Protokoll des Virenscanners.

C:\Users\Xdream\AppData\Local\Temp\msprint.exe
C:\Windows\vadokmxt.dll
C:\Windows\wdpoefan.dll

Werte mal diese drei Dateien nacheinander hier aus und poste sämtliche Ergebnisse, also auch inkl. der Prüfsummenangaben - danach sehen wir mal weiter was sich da machen lässt.

xdreamIV · 23.04.2008, 19:42

Ich denke es war der I-Net Explorer 7, welche Seite es jetzt genau war, kann ich nicht mehr sagen, sofort alles zugemacht was offen war nach der Nortonmeldung, war auf der Suche nach einem Freeware-Stimmverzerrer, viele Vorschläge und Links gefunden, einer war dann wohl der Falsche.

Nortonmeldung:
Ein Eindringsversuch von XDREAMIV-PC wurde blockiert.
Name des Risikos: HTTP Trojan Zlob
Risikostufe: Hoch
Standardaktionen: Blockieren
Durchgeführte Aktion: Blockieren
Angreifender Computer: XDREAMIV-PC (IP***)
Zieladresse: Kann ich die IP einfach so rausgeben?
Trafficbeschreibung: TCP, ***(das hier auch?)

-----------------
Zu den Dateiprüfungen, hab ich die erste mal geprüft (richtig so?):

Datei msprint.exe empfangen 2008.04.23 20:15:42 (CET)Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.4.23.0 2008.04.23 -
AntiVir 7.8.0.8 2008.04.23 TR/Agent.fwi
Authentium 4.93.8 2008.04.22 -
Avast 4.8.1169.0 2008.04.23 Win32:Agent-SVL
AVG 7.5.0.516 2008.04.23 Dropper.Agent.HTW
BitDefender 7.2 2008.04.23 Trojan.Dropper.Zirit.E
CAT-QuickHeal 9.50 2008.04.23 -
ClamAV 0.92.1 2008.04.23 -
DrWeb 4.44.0.09170 2008.04.23 Trojan.Click.origin
eSafe 7.0.15.0 2008.04.21 Suspicious File
eTrust-Vet 31.3.5728 2008.04.23 -
Ewido 4.0 2008.04.23 -
F-Prot 4.4.2.54 2008.04.22 -
F-Secure 6.70.13260.0 2008.04.23 Trojan-Dropper.Win32.Agent.qlx
FileAdvisor 1 2008.04.23 -
Fortinet 3.14.0.0 2008.04.23 -
Ikarus T3.1.1.26 2008.04.23 Trojan-Clicker.Win32.Small.BG
Kaspersky 7.0.0.125 2008.04.23 Trojan-Dropper.Win32.Agent.qlx
McAfee 5279 2008.04.23 Generic Dropper.au
Microsoft 1.3408 2008.04.22 -
NOD32v2 3049 2008.04.23 a variant of Win32/TrojanDropper.Agent.NJP
Norman 5.80.02 2008.04.23 -
Panda 9.0.0.4 2008.04.23 Suspicious file
Prevx1 V2 2008.04.23 TROJAN.AU
Rising 20.41.22.00 2008.04.23 Trojan.DL.Win32.Small.tqz
Sophos 4.28.0 2008.04.23 Mal/Heuri-E
Sunbelt 3.0.1056.0 2008.04.17 -
Symantec 10 2008.04.23 -
TheHacker 6.2.92.288 2008.04.23 -
VBA32 3.12.6.4 2008.04.16 suspected of Embedded.Trojan-Downloader.Win32.Small.ivo
VirusBuster 4.3.26:9 2008.04.23 -
Webwasher-Gateway 6.6.2 2008.04.23 Trojan.Agent.kri

weitere Informationen
File size: 55296 bytes
MD5...: 386fb81ddde54254f521ec4f5a5bef63
SHA1..: 76b31c268b43e640e4d7e53b0e11bc775b26dabb
SHA256: 0eedbe394ea678ae1ceea7f48e4874c3d238fd65ab7ab9cef5e049131f92d13e
SHA512: 328e9636bd11d185ad5d7117a9ed079cd367cc4a86e70118d6de485ace235d33 965b6eca76ec4b4f4e06f093301355dd0c4f01dfd7cf9e7ded9ee7ceef13b047
PEiD..: PECompact 2.xx --> BitSum Technologies
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x401574 timedatestamp.....: 0x480da715 (Tue Apr 22 08:51:33 2008) machinetype.......: 0x14c (I386) ( 2 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x16000 0xca00 7.68 eda6b6b6c27235f960a3e43388a82bc9 .rsrc 0x17000 0x1000 0xa00 6.62 61f1f725d6d59057f8f2d76e475c7603 ( 1 imports ) > kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree ( 0 exports ) 
packers: PECompact, PECompact
packers: PecBundle, PECompact
packers: PE_Patch.PECompact, PecBundle, PECompact
Prevx info: MSPRINT.EXE - Prevx

Ergebnis: 17/32 (53.13%)

------------------------

nun auch die anderen Zwei:

C:\Windows\vadokmxt.dll
Antivirus;Version;letzte aktualisierung;Ergebnis
AhnLab-V3;2008.4.23.0;2008.04.23;-
AntiVir;7.8.0.8;2008.04.23;ADSPY/AdSpy.Gen
Authentium;4.93.8;2008.04.22;-
Avast;4.8.1169.0;2008.04.23;Win32:Vapsup-BU
AVG;7.5.0.516;2008.04.23;Downloader.Adload.FQ
BitDefender;7.2;2008.04.23;-
CAT-QuickHeal;9.50;2008.04.23;-
ClamAV;0.92.1;2008.04.23;-
DrWeb;4.44.0.09170;2008.04.23;-
eSafe;7.0.15.0;2008.04.21;-
eTrust-Vet;31.3.5728;2008.04.23;Win32/Pripecs!generic
Ewido;4.0;2008.04.23;-
F-Prot;4.4.2.54;2008.04.23;-
F-Secure;6.70.13260.0;2008.04.23;-
FileAdvisor;1;2008.04.23;-
Fortinet;3.14.0.0;2008.04.23;-
Ikarus;T3.1.1.26.0;2008.04.23;Virus.Win32.Agent.LTS
Kaspersky;7.0.0.125;2008.04.23;-
McAfee;5279;2008.04.23;-
Microsoft;1.3408;2008.04.22;Trojan:Win32/Zlob.AI
NOD32v2;3049;2008.04.23;-
Norman;5.80.02;2008.04.23;-
Panda;9.0.0.4;2008.04.23;-
Prevx1;V2;2008.04.23;Downloader.Adload.FQ
Rising;20.41.22.00;2008.04.23;Trojan.DL.Win32.QQHelper.bdp
Sophos;4.28.0;2008.04.23;-
Sunbelt;3.0.1056.0;2008.04.17;-
Symantec;10;2008.04.23;-
TheHacker;6.2.92.289;2008.04.23;-
VBA32;3.12.6.4;2008.04.16;suspected of Downloader.Zlob.7
VirusBuster;4.3.26:9;2008.04.23;-
Webwasher-Gateway;6.6.2;2008.04.23;Ad-Spyware.AdSpy.Gen

weitere Informationen
File size: 221184 bytes
MD5...: e232edeb12a526949f2a63729f0ba04b
SHA1..: 81566f68ef169632a5daff91617dab7b2c4b371f
SHA256: 990c99c53546715645919477759381babad1454ce6d66f2a5b5d9a296793b8fc
SHA512: 8e3735d085fc306bd75ed10834b0674aa49df0be81cce8589517e4e6f5473539 e220611d8f260ade93e349323936125ee22c8b4ad3aefb59d782ee67066415d1
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000da48 timedatestamp.....: 0x480e0c4e (Tue Apr 22 16:03:26 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x2eef6 0x2f000 6.39 782355bf93e40d65a43e5537d6dd507a .data 0x30000 0x2eac 0x2000 1.57 05ded1aaa7b900a5c901b62698b06364 .rsrc 0x33000 0x10 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .reloc 0x34000 0x24d0 0x3000 4.02 9c5600f9c7191b51d450ebc456147a7d ( 4 imports ) > KERNEL32.dll: Sleep, GetLastError, CloseHandle, GetSystemTime, CreateEventW, WaitForSingleObject, MultiByteToWideChar, LoadLibraryW, SystemTimeToFileTime, GetFileAttributesW, CreateFileW, ReadFile, GetCurrentDirectoryW, LocalFileTimeToFileTime, WideCharToMultiByte, CreateDirectoryW, WriteFile, SetFileTime, GetProcAddress, FindClose, SetFilePointer, FindFirstFileW, SetEndOfFile, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, HeapAlloc, GetCurrentThreadId, GetCommandLineA, GetVersionExA, GetProcessHeap, RaiseException, RtlUnwind, GetModuleHandleA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, ExitProcess, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetConsoleCP, GetConsoleMode, HeapSize, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, FlushFileBuffers, GetCPInfo, GetACP, GetOEMCP, LCMapStringA, LCMapStringW, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, GetModuleFileNameA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, CompareStringA, CompareStringW, SetEnvironmentVariableA, SetEnvironmentVariableW, LoadLibraryA, InitializeCriticalSection, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, CreateFileA > ADVAPI32.dll: RegDeleteValueW, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW > ole32.dll: CoInitialize > SHLWAPI.dll: SHDeleteKeyW ( 0 exports ) 
Prevx info: VADOKMXT.DLL - Prevx

Ergebnis: 10/32 (31.25%)

-------------------------------------------------------
C:\Windows\wdpoefan.dll
Antivirus;Version;letzte aktualisierung;Ergebnis
AhnLab-V3;2008.4.23.0;2008.04.23;-
AntiVir;7.8.0.8;2008.04.23;ADSPY/Agent.PB
Authentium;4.93.8;2008.04.22;-
Avast;4.8.1169.0;2008.04.23;Win32:Agent-LTS
AVG;7.5.0.516;2008.04.23;Downloader.Adload.FP
BitDefender;7.2;2008.04.23;-
CAT-QuickHeal;9.50;2008.04.23;-
ClamAV;0.92.1;2008.04.23;-
DrWeb;4.44.0.09170;2008.04.23;-
eSafe;7.0.15.0;2008.04.21;-
eTrust-Vet;31.3.5728;2008.04.23;-
Ewido;4.0;2008.04.23;-
F-Prot;4.4.2.54;2008.04.23;-
FileAdvisor;1;2008.04.23;-
Fortinet;3.14.0.0;2008.04.23;-
Ikarus;T3.1.1.26;2008.04.23;Virus.Win32.Agent.LTS
Kaspersky;7.0.0.125;2008.04.23;-
Microsoft;1.3408;2008.04.22;Trojan:Win32/Zlob.AI
NOD32v2;3049;2008.04.23;-
Norman;5.80.02;2008.04.23;-
Panda;9.0.0.4;2008.04.23;-
Prevx1;V2;2008.04.23;Downloader.Adload.FP
Rising;20.41.22.00;2008.04.23;Trojan.Win32.Zlob.ajl
Sophos;4.28.0;2008.04.23;-
Sunbelt;3.0.1056.0;2008.04.17;-
Symantec;10;2008.04.23;-
TheHacker;6.2.92.289;2008.04.23;-
VBA32;3.12.6.4;2008.04.16;suspected of Downloader.Zlob.7
VirusBuster;4.3.26:9;2008.04.23;-
Webwasher-Gateway;6.6.2;2008.04.23;Ad-Spyware.Agent.PB

weitere Informationen
File size: 258048 bytes
MD5...: ed43996960dffa91cc3dda8d5cf3983f
SHA1..: ddd7f90e4781429d89f31b7e64b67f0cbeace5b3
SHA256: d270c9bf0e9af370ae8ac24ca92f9418fefa62fc401828bad88a2fb7aa761f15
SHA512: 0b3eafa8299dee36226fe2c2c7c8c7a154a60ae6b071d87751ae3b94b6bbea4e 6506ba0057ff4d468b25723e366b96464e7e1a283cd95e9f3609cdae96015efc
PEiD..: -
PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000fa9a timedatestamp.....: 0x480e0e91 (Tue Apr 22 16:13:05 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x32a0c 0x33000 6.43 ec03ba53dfa3aee66045fe74c456b276 .data 0x34000 0x32c0 0x2000 2.59 b4ec75288b85ce13532392ed291d2b77 .rsrc 0x38000 0x51e0 0x6000 4.10 53795bf5b0a0764d6cef511602afcaf6 .reloc 0x3e000 0x24d8 0x3000 4.11 c35bddc4b791b54560ec287809401bba ( 5 imports ) > KERNEL32.dll: CreateDirectoryW, MoveFileW, WaitForSingleObject, Sleep, FindFirstFileW, FindClose, GetProcAddress, LoadLibraryW, GetLastError, MultiByteToWideChar, CloseHandle, SetFilePointer, SystemTimeToFileTime, GetFileAttributesW, ReadFile, GetCurrentDirectoryW, LocalFileTimeToFileTime, WideCharToMultiByte, SetFileTime, SetEndOfFile, WriteFile, CreateFileW, lstrcpynW, GetSystemTime, GetLocaleInfoA, FindNextFileW, FileTimeToSystemTime, FileTimeToLocalFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapFree, HeapAlloc, GetCurrentThreadId, GetCommandLineA, GetVersionExA, GetProcessHeap, RaiseException, RtlUnwind, GetModuleHandleA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, InterlockedDecrement, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, ExitProcess, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetConsoleCP, GetConsoleMode, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, GetCPInfo, GetACP, GetOEMCP, LCMapStringA, LCMapStringW, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, GetModuleFileNameA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetTimeZoneInformation, HeapSize, CompareStringA, CompareStringW, SetEnvironmentVariableA, SetEnvironmentVariableW, LoadLibraryA, InitializeCriticalSection, SetStdHandle, FlushFileBuffers, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetStringTypeA, GetStringTypeW, CreateFileA > USER32.dll: MessageBoxW, GetDesktopWindow, GetWindow > ADVAPI32.dll: RegDeleteValueW, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW > ole32.dll: CoInitialize > SHLWAPI.dll: SHDeleteKeyW ( 0 exports ) 
Prevx info: WDPOEFAN.DLL - Prevx

Ergebnis: 9/30 (30%)

cosinus · 23.04.2008, 22:15

Ahja. Zlob/smitfraud Befall ist schonmal sicher - sicheres Entfernen leider nur durch Neuinstallation des Betriebssystems möglich (wenn Du wirklich sichergehen gehen willst!!) ansonsten dürfte der smitfraudfix recht gute zuverlässige Dienste in Deinem Fall leisten. Folge mal der Zlob-Entferungsanleitung hier im FAQ-Bereich. Poste die relevanten Logfiles.

xdreamIV · 24.04.2008, 12:01

Also hab SmitFraudFix im abgesicherten Modus ausgeführt, Neugestartet und schonmal keine Fehlermeldung einer dll bekommen.

Leider sprengte der SmitFraudFix-Rapport den Rahmen der Zeichenbegrenzung.
"Der Text, den Sie eingegeben haben, besteht aus 238418 Zeichen und ist damit zu lang. Bitte kürzen Sie den Text auf die maximale Länge von 25000 Zeichen."

Darum habe ich mich dafür entschieden die Logs als .txt-Datei auf Doktus.de abzuspeichern, anstatt X-Posts zu schreiben (was wohl auch gegen die Forenregeln verstossen würde).

Hier das SmitFraudFix Ergebnis:
http://www.doktus.de/dok/50725/smitfraudfixlog.html (auf der Linken Seite wäre ein Download der Datei möglich)

und Hier wie in der FAQ geschrieben steht auch das neue HiJackThis-Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:35:14, on 24.04.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\schtasks.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9c.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: (no name) - {6CB07271-D192-442A-8480-E99102A5C60E} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DelayLoad] C:\Users\Xdream\AppData\Local\Temp\msprint.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: vadokmxt - {CCA2DB67-418F-4AE5-B3BF-E5EE7F53F91A} - C:\Windows\vadokmxt.dll
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 8736 bytes

--------------------------------------------------

Danke sehr für die bisherige Hilfe!
Ich hoffe, ich bringe den PC bald sauber, eigentlich ist er erst ein paar Tage alt aus dem Geschäft, ich hoffe nicht, dass ein Neuaufsetzen nötig ist, da keine Vista-CD mitgeliefert wurde

.

Schöne Grüsse Xdream.

xdreamIV · 24.04.2008, 17:44

Kann es sein, dass man einen Beitrag nach einiger Zeit nicht mehr editieren kann? Ich wollte Doppelposts zwar vermeiden, aber dachte dann das folgendes doch von Bedeutung sein könnte..

Norton gab vorhin gerade nochmal ein paar Meldungen durch alle Relevanten Angaben dazu:

Titel: Downloader.Zlob!gen.2 erkannt von Virenprüfprogramm
Riskokategorie: Virus
Risikotyp: Dateibasiert
Risikostufe: Niedrig
Risikozustand: Entfernen nicht versucht

Betrochener Bereich:
2 Registrierungseinträge:
HKEY_CLASSES_ROOT\CLSID\{CCA2DB67-418F-4AE5-B3BF-E5EE7F53F91A}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad->vadokmt
1 Datei:
c:\windows\vadokmt.dll
1 Browser-Cache:
wird nicht angezeigt

------------
Kurz darauf die Meldung:
Titel: Downloader.Zlob!gen.2 erkannt von Auto-Protect
Riskokategorie: Virus
Risikotyp: Dateibasiert
Risikostufe: Niedrig
Risikozustand: Vollständig entfernt

Betroffener Bereich:
1 Datei: c:\windows\qnmargolftv.dll
1 Browser-Cache:
Details wieder leer

--------------

6 Sekunden später nochmal die genau gleiche meldung mit dem Betroffenen Bereich diesmal:
1 Datei: c:\windows\vadokmt.dll
1 Browser-Cache:
Details wieder leer

Norton meint angeblich das Ding entfernt zu haben, und das ohne mein Eingreiffen :/...

Ausserdem findet Norton bei jeder Systemprüfung 5 gewisse Tracking-Cookies (obwohl nur 4 mit Namen angezeigt werden) wie er sie nennt..
Cookie:xdream@fc.webmasterpro.de/
Cookie:xdream@msnportal.112.2o7.net/
Cookie:xdream@ad.yieldmanager.com/
Cookie:xdream@adopt.euroclick.com/

Immer wähle ich zwischen den 3 Optionen Reparieren, Ignorieren, Ausschliessen, die Wahl "Reparieren", damit sagt er das Problem sei behoben, bei der nächsten Prüfung werden sie aber wieder gefunden..
Habe das gefühl, dass ich ziemlich in der Sch**sse stecke :/

cosinus · 27.04.2008, 19:41

Besorg Dir mal den Avenger nach dieser Anleitung. Kopier das hier ins weiße Feld hinein, der Rest nach Anleitung:

Code:

ATTFilter

Files to delete:
C:\Users\Xdream\AppData\Local\Temp\msprint.exe
C:\Windows\vadokmxt.dll

Poste dann nach dem Reboot das Avenger Logfile. Erstell danach auch ein neues HijackThis log und poste es ebenfalls - alle Logs bitte mit Code tags umschlossen posten (hier bei den Schaltflächen das #-Symbol

)

xdreamIV · 28.04.2008, 10:58

Nach dem Ausführen und Rebooten kam die Meldung "Window - Kein Datenträger" Exception Processing MEssage 0xc0000013 Parameters 0x76E023C 0x83840CBC 0x762E023C 0x76E023C0
Mit der Auswahl "Abbrechen", "Wiederholen" und "Weiter", bei Wiederholen kam der Fehler erneut..
Naja das Logfile von avenger gibt Klarheit, anscheinend sind die besagten Dateien nicht mehr vorhanden..:

Code:

ATTFilter

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform:  Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error:  file "C:\Users\Xdream\AppData\Local\Temp\msprint.exe" not found!
Deletion of file "C:\Users\Xdream\AppData\Local\Temp\msprint.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Error:  file "C:\Windows\vadokmxt.dll" not found!
Deletion of file "C:\Windows\vadokmxt.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
  --> the object does not exist


Completed script processing.

*******************

Finished!  Terminate.

HiJackThis Logfile:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:55:19, on 28.04.2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conime.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\schtasks.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\wuauclt.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navw32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: (no name) - {6CB07271-D192-442A-8480-E99102A5C60E} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [DelayLoad] C:\Users\Xdream\AppData\Local\Temp\msprint.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: vadokmxt - {CCA2DB67-418F-4AE5-B3BF-E5EE7F53F91A} - C:\Windows\vadokmxt.dll (file missing)
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 8874 bytes

----

Nebenfrage, gibt es eine Software mit der man alle Prozesse im Taskmanager prüfen kann, ich trau irgendwie nicht allen?..

cosinus · 28.04.2008, 12:47

Starte mal HijackThis mit do a system scan only, marker diese Einträge an:

Code:

ATTFilter

O3 - Toolbar: (no name) - {6CB07271-D192-442A-8480-E99102A5C60E} - (no file)
O4 - HKLM\..\Run: [DelayLoad] C:\Users\Xdream\AppData\Local\Temp\msprint.exe
O21 - SSODL: vadokmxt - {CCA2DB67-418F-4AE5-B3BF-E5EE7F53F91A} - C:\Windows\vadokmxt.dll (file missing)

und klick unten auf den Button fix checked. Es empfiehlt sich, alle anderen Programme und besonders alle Explorerfenster vor dem Fixen zu schließen.

Starte Dein System neu und erstell und poste ein neues HijackThis Logfile. Danach sehen wir weiter.

xdreamIV · 28.04.2008, 16:52

Alles klar:

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:50:03, on 28.04.2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: HP Chasis Button Service (HPBtnSrv) - Unknown owner - c:\hp\HPEZBTN\HPBtnSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

--
End of file - 8428 bytes

xdreamIV · 29.04.2008, 10:29

Hab heute mal Norton und Spybot Search & Destroy drüber laufen lassen, beide nix gefunden, zusätzlich noch den Kaspersky Online Scan, der hat eigentlich auch nichts gefunden bis auf:

Code:

ATTFilter

Viren gefunden 1 
Infizierte Objekte gefunden 4 

C:\Users\Xdream\Desktop\SmitfraudFix\Reboot.exe  Infizierte Objekte: not-a-virus:RiskTool.Win32.Reboot.f  übersprungen  
 
C:\Users\Xdream\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe  Infizierte Objekte: not-a-virus:RiskTool.Win32.Reboot.f  übersprungen  
 
C:\Users\Xdream\Desktop\SmitfraudFix.exe/data.rar  Infizierte Objekte: not-a-virus:RiskTool.Win32.Reboot.f  übersprungen  
 
C:\Users\Xdream\Desktop\SmitfraudFix.exe  RarSFX: infiziert - 2  übersprungen

Ich denke aber, dass das ne puure Fehlermeldung ist, immerhin habe ich die Smitfraudfix.exe ja von hier =).

cosinus · 29.04.2008, 12:23

Dein HijackThis Logfile sieht mittlerweile auch wieder gut aus. Mach noch mal bitte ein Log mit silentrunners, folge dem gleichnamigen Link in meiner Signatur.

xdreamIV · 29.04.2008, 16:50

hier wäre also dann der log:

Code:

ATTFilter

"Silent Runners.vbs", revision 56, http://www.silentrunners.org/
Operating System: Windows Vista
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Sidebar" = "C:\Program Files\Windows Sidebar\sidebar.exe /autoRun" [MS]
"WindowsWelcomeCenter" = "rundll32.exe oobefldr.dll,ShowWelcomeCenter" [MS]
"ehTray.exe" = "C:\Windows\ehome\ehTray.exe" [MS]
"WMPNSCFG" = "C:\Program Files\Windows Media Player\WMPNSCFG.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Windows Defender" = "C:\Program Files\Windows Defender\MSASCui.exe -hide"
"hpsysdrv" = "c:\hp\support\hpsysdrv.exe" ["Hewlett-Packard Company"]
"KBD" = "C:\HP\KBD\KbdStub.EXE" [null data]
"OsdMaestro" = ""C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"" ["OsdMaestro"]
"NvSvc" = "RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart" [MS]
"NvCplDaemon" = "RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup" [MS]
"NvMediaCenter" = "RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"RtHDVCpl" = "RtHDVCpl.exe" ["Realtek Semiconductor"]
"CCUTRAYICON" = "FactoryMode" [file not found]
"HP Health Check Scheduler" = "c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [null data]
"Adobe Reader Speed Launcher" = ""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"" ["Adobe Systems Incorporated"]
"SunJavaUpdateReg" = ""C:\Windows\system32\jureg.exe"" ["Sun Microsystems, Inc."]
"HP Software Update" = "c:\Program Files\HP\HP Software Update\HPWuSchd2.exe" ["Hewlett-Packard Co."]
"ccApp" = ""c:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"(Default)" = (empty string) [file not found]
"Symantec PIF AlertEng" = ""C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"" ["Symantec Corporation"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"Launcher" = "C:\Windows\SMINST\launcher.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Adobe PDF Reader"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{1E8A6170-7264-4D0F-BEAE-D42A53123C75}\(Default) = (no title provided)
  -> {HKLM...CLSID} = (no title provided)
                   \InProcServer32\(Default) = "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll" ["Symantec Corporation"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "SSVHelper Class"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]
{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
  -> {HKLM...CLSID} = "Windows Live Anmelde-Hilfsprogramm"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
  -> {HKLM...CLSID} = "DesktopContext Class"
                   \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
  -> {HKLM...CLSID} = "NVIDIA CPL Extension"
                   \InProcServer32\(Default) = "C:\Windows\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "ShellViewRTF"
  -> {HKLM...CLSID} = "ShellViewRTF"
                   \InProcServer32\(Default) = "C:\Windows\System32\ShellvRTF.dll" ["XSS"]
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders"
  -> {HKLM...CLSID} = "Meine freigegebenen Ordner"
                   \InProcServer32\(Default) = "C:\Program Files\Windows Live\Messenger\fsshext.8.5.1302.1018.dll" [MS]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
  -> {HKLM...CLSID} = "PDF Shell Extension"
                   \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
                   \InProcServer32\(Default) = "c:\PROGRA~1\NORTON~1\NORTON~1\NavShExt.dll" ["Symantec Corporation"]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}"
  -> {HKLM...CLSID} = "IEContextMenu Class"
                   \InProcServer32\(Default) = "c:\PROGRA~1\NORTON~1\NORTON~1\NavShExt.dll" ["Symantec Corporation"]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"ConsentPromptBehaviorAdmin" = (REG_DWORD) dword:0x00000002
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Administrators In Admin Approval Mode}

"ConsentPromptBehaviorUser" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Behavior Of The Elevation Prompt For Standard Users}

"EnableInstallerDetection" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Detect Application Installations And Prompt For Elevation}

"EnableLUA" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Run All Administrators In Admin Approval Mode}

"EnableSecureUIAPaths" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Only elevate UIAccess applications that are installed in secure locations}

"EnableVirtualization" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Virtualize file and registry write failures to per-user locations}

"PromptOnSecureDesktop" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Switch to the secure desktop when prompting for elevation}

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

"FilterAdministratorToken" = (REG_DWORD) dword:0x00000000
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
User Account Control: Admin Approval Mode for the Built-in Administrator Account}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Users\Xdream\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\Windows\system32\ssBranded.scr" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\system32\NLAapi.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\system32\napinsp.dll" [MS]
000000000005\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]
000000000006\LibraryPath = "%SystemRoot%\system32\pnrpnsp.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 18


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{90222687-F593-4738-B738-FBEE9C7B26DF}" = "NCO Toolbar"
  -> {HKLM...CLSID} = "Show Norton Toolbar"
                   \InProcServer32\(Default) = "c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll" ["Symantec Corporation"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}"
  -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01"
                   \InProcServer32\(Default) = "C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Automatische WLAN-Konfiguration, Wlansvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\wlansvc.dll" [MS]}
Automatisches LiveUpdate - Scheduler, Automatisches LiveUpdate - Scheduler, ""C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"]
CNG-Schlüsselisolation, KeyIso, "C:\Windows\system32\lsass.exe" [MS]
Computerbrowser, Browser, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\browser.dll" [MS]}
DQLWinService, DQLWinService, ""C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe"" [null data]
Extensible Authentication-Protokoll, EapHost, "C:\Windows\System32\svchost.exe -k netsvcs" {"C:\Windows\System32\eapsvc.dll" [MS]}
HP Chasis Button Service, HPBtnSrv, "c:\hp\HPEZBTN\HPBtnSrv.exe" [null data]
HP Health Check Service, HP Health Check Service, ""c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe"" [null data]
LightScribeService Direct Disc Labeling Service, LightScribeService, ""c:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"]
LiveUpdate Notice Service Ex, LiveUpdate Notice Ex, ""c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"]
LVCOMSer, LVCOMSer, ""C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe"" ["Logitech Inc."]
Process Monitor, LVPrcSrv, ""C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe"" ["Logitech Inc."]
Symantec AppCore Service, SymAppCore, ""c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe"" ["Symantec Corporation"]
Symantec Core LC, Symantec Core LC, ""C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"]
Symantec Lic NetConnect service, CLTNetCnService, ""c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h cltCommon" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon" ["Symantec Corporation"]
Windows Driver Foundation - Benutzermodus-Treiberframework, wudfsvc, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\System32\WUDFSvc.dll" [MS]}
Windows Media Player-Netzwerkfreigabedienst, WMPNetworkSvc, ""C:\Program Files\Windows Media Player\wmpnetwk.exe"" [MS]
Windows-Bilderfassung, stisvc, "C:\Windows\system32\svchost.exe -k imgsvc" {"C:\Windows\System32\wiaservc.dll" [MS]}
Zugriff auf Eingabegeräte, hidserv, "C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted" {"C:\Windows\system32\hidserv.dll" [MS]}


---------- (launch time: 2008-04-29 17:47:08)
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
  DLL launch points, use the -supp parameter or answer "No" at the
  first message box and "Yes" at the second message box.
---------- (total run time: 43 seconds, including 18 seconds for message boxes)

cosinus · 29.04.2008, 20:34

Ich sehe da eine Datei, die ich so nicht kenne. Mag an meiner Unerfahrenheit mit Vista liegen

und auch weil ich nicht wirklich brauchbare Infos via Google bekam.

C:\Windows\SMINST\launcher.exe

Das ist sie. Werte sie mal bitte sicherheitshalber bei Virustotal aus und poste alle Ergebnisse mit Angaben zur Dateigröße und Prüfsummen (md5, sha-1).

xdreamIV · 30.04.2008, 07:41

Code:

ATTFilter

Datei launcher.exe empfangen 2008.04.30 08:29:45 (CET)
Status: Beendet
Ergebnis: 1/31 (3.23%)


Antivirus Version letzte aktualisierung Ergebnis 
AhnLab-V3 2008.4.30.0 2008.04.30 - 
AntiVir 7.8.0.10 2008.04.29 - 
Authentium 4.93.8 2008.04.27 - 
Avast 4.8.1169.0 2008.04.29 - 
AVG 7.5.0.516 2008.04.30 - 
BitDefender 7.2 2008.04.30 - 
CAT-QuickHeal 9.50 2008.04.29 - 
ClamAV 0.92.1 2008.04.30 - 
DrWeb 4.44.0.09170 2008.04.29 - 
eSafe 7.0.15.0 2008.04.28 - 
eTrust-Vet 31.3.5746 2008.04.30 - 
Ewido 4.0 2008.04.29 - 
F-Prot 4.4.2.54 2008.04.30 - 
F-Secure 6.70.13260.0 2008.04.30 - 
Fortinet 3.14.0.0 2008.04.29 - 
Ikarus T3.1.1.26 2008.04.30 Virus.Trojan.Win32.Agent.ckk 
Kaspersky 7.0.0.125 2008.04.30 - 
McAfee 5284 2008.04.29 - 
Microsoft 1.3408 2008.04.22 - 
NOD32v2 3064 2008.04.29 - 
Norman 5.80.02 2008.04.29 - 
Panda 9.0.0.4 2008.04.30 - 
Prevx1 V2 2008.04.30 - 
Rising 20.42.12.00 2008.04.29 - 
Sophos 4.28.0 2008.04.30 - 
Sunbelt 3.0.1056.0 2008.04.17 - 
Symantec 10 2008.04.30 - 
TheHacker 6.2.92.297 2008.04.29 - 
VBA32 3.12.6.5 2008.04.29 - 
VirusBuster 4.3.26:9 2008.04.29 - 
Webwasher-Gateway 6.6.2 2008.04.30 - 

weitere Informationen 
File size: 44168 bytes 
MD5...: 31539595f006dae39f719735f30c3570 
SHA1..: f883a7708d7d0427450a85b1802a1325eaf04b0e 
SHA256: 9484ff4ae6d74caee4aa0003d4e5aa58bd29473635712fa63e0be90d83bb88ae 
SHA512: f287011591792244288b5c2b394c57e0aa0274f005d9e1882951553a3651dcc2
79cce2b07c94ab839c63f112d7a13948692dea1ba707304a978f123e65815f63


PEiD..: - 
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x404858
timedatestamp.....: 0x454f2771 (Mon Nov 06 12:15:45 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x41c9 0x5000 5.38 5c5a7f6e4e9784110db25bddcc6dee3c
.rdata 0x6000 0x1458 0x2000 3.03 ae638035d8f027226689b7c38288aca2
.data 0x8000 0xb30 0x1000 2.60 90612eb9fcc7c59a48e1552b7ea3bb65
.rsrc 0x9000 0x3b0 0x1000 0.96 3b4d5d544aab5d57e8e6f20740ea399c

( 7 imports ) 
> MFC42u.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> msvcrt.dll: __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _cexit, _XcptFilter, _exit, __p__fmode, __1type_info@@UAE@XZ, _onexit, __dllonexit, __set_app_type, _ltow, __CxxFrameHandler, wcscmp, wcslen, _terminate@@YAXXZ, _controlfp, _c_exit, _except_handler3, _wgetenv, _wcsicmp
> KERNEL32.dll: CreateFileW, DeleteFileW, SetFileAttributesW, SetLastError, FormatMessageW, GetLastError, GlobalFree, GlobalUnlock, GetPrivateProfileStringW, GlobalAlloc, GetModuleFileNameW, GetVersionExW, GetModuleHandleA, GetStartupInfoA, GetPrivateProfileIntW, GetCurrentDirectoryW, GlobalLock, GetExitCodeProcess, CloseHandle, WaitForSingleObject, CreateProcessW
> USER32.dll: wvsprintfW
> ADVAPI32.dll: RegSetValueExW, RegCloseKey, RegOpenKeyW
> VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW
> SHLWAPI.dll: PathStripPathW

( 0 exports )

Merkwürdig, ein Virenscanner erkennt die Datei als schädlich =)

29.04.2008, 12:23	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Fehler beim Laden von .dll Dein HijackThis Logfile sieht mittlerweile auch wieder gut aus. Mach noch mal bitte ein Log mit silentrunners, folge dem gleichnamigen Link in meiner Signatur. __________________ Logfiles bitte immer in CODE-Tags posten

Fehler beim Laden von .dll

Log-Analyse und Auswertung: Fehler beim Laden von .dll