|
Log-Analyse und Auswertung: bitte mal anschauenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
06.01.2005, 16:27 | #1 |
| bitte mal anschauen Könnt ihr mal bitte das Logfile anschauen. Mein Computer stürzt des öfteren ab (blueScreen) Logfile of HijackThis v1.99.0 Scan saved at 16:19:49, on 06.01.2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\SSDPSRV.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAMME\TELEDAT\WCOM\SYSTEM\RVSINST.EXE C:\WINDOWS\SYSTEM\INETSRV\INETINFO.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\PROGRAMME\GEMEINSAME DATEIEN\SOFTWIN\BITDEFENDER SCAN SERVER\BDSS.EXE C:\PROGRAMME\GEMEINSAME DATEIEN\SOFTWIN\BITDEFENDER COMMUNICATOR\XCOMMSVR.EXE C:\WINDOWS\SYSTEM\MSDTCW.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\HPZTSB03.EXE C:\PROGRAMME\LOGITECH\ITOUCH\ITOUCH.EXE C:\WINDOWS\SYSTEM\QTTASK.EXE C:\WINDOWS\RUNDLL32.EXE C:\WINDOWS\RUNDLL32.EXE C:\STHVCD55\SYSEXPLR.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\HIDSERV.EXE C:\PROGRAMME\GEMEINSAME DATEIEN\REAL\UPDATE_OB\REALSCHED.EXE C:\WINDOWS\SYSTEM\PWSTRAY.EXE C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\VSSERV.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAM FILES\WINDOWS ADCONTROL\WINADCTL.EXE C:\PROGRAMME\TUNEUP UTILITIES 2004\MEMOPTIMIZER.EXE C:\PROGRAMME\EUMEX 724PC DSL\CAPICTRL.EXE C:\PROGRAM FILES\WINDOWS ADCONTROL\WINADALT.EXE C:\PROGRAMME\EUMEX 724PC DSL\HNETCTRL.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\VSSERV.EXE C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\BDMCON.EXE C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\BDLITE.EXE C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE C:\EIGENE DATEIEN\EIGENE DOWNLOADS\HIJACKTHIS_199\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.t-online.de/software/ie50/setpxy.pac R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=ftp-proxy.btx.dtag.de:80;http=proxy.btx.dtag.de:80 F1 - win.ini: run=hpfsched O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAMME\YAHOO!\MESSENGER\YCOMP.DLL O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRAMME\FLASHFXP\IEFLASH.DLL O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAMME\YAHOO!\MESSENGER\YCOMP.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe C:\PROGRA~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain O4 - HKLM\..\Run: [SysExplr] C:\STHVCD55\SysExplr.EXE O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PWSTray] PwsTray.exe O4 - HKLM\..\Run: [BitDefender Virus Shield] C:\Programme\Softwin\BitDefender Professional Edition\\vsserv.exe O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\SOFTWIN\BITDEF~1\BDMCON.EXE O4 - HKLM\..\Run: [BDNewsAgent] C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\bdnagent.exe O4 - HKLM\..\Run: [BDSwitchAgent] C:\PROGRAMME\SOFTWIN\BITDEFENDER PROFESSIONAL EDITION\bdswitch.exe O4 - HKLM\..\Run: [Windows AdControl] C:\PROGRAM FILES\WINDOWS ADCONTROL\WINADCTL.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [RVS Installer] C:\PROGRA~1\TELEDAT\WCOM\SYSTEM\RVSINST.EXE O4 - HKLM\..\RunServices: [MSDTC] msdtcw -start O4 - HKLM\..\RunServices: [inetinfo.exe] C:\WINDOWS\SYSTEM\inetsrv\inetinfo.exe -e w3svc O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [BitDefender Scan Server] C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\\bdss.exe O4 - HKLM\..\RunServices: [BitDefender Communicator] C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\\xcommsvr.exe O4 - HKLM\..\RunServices: [BitDefender Live! Init] C:\Programme\Softwin\BitDefender Professional Edition\\bdinit.exe O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\PROGRAMME\TUNEUP UTILITIES 2004\MemOptimizer.exe" autostart O4 - Startup: Logitech Desktop Messenger.lnk = C:\Programme\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Startup: CAPI Control.lnk = C:\Programme\Eumex 724PC DSL\Capictrl.exe O4 - Startup: HomeNet Control.lnk = C:\Programme\Eumex 724PC DSL\HNetCtrl.exe O8 - Extra context menu item: Zur Filterliste hinzufügen (WebWasher) - http://-Web.Washer-/ie_add O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000 Zweiter Teil folgt geleich wegen Längenbegrenzung |
06.01.2005, 16:28 | #2 |
| bitte mal anschauen O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
__________________O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Reference 2001\EROProj.dll O9 - Extra button: Preispiraten - {94A15285-AAE6-44E8-B2D7-4A2C6CDA9185} - C:\Programme\Preispiraten\preispiraten.exe O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: concept/design's onlineTV - {9AE9F385-5C76-4531-9F1C-E7AB7E512029} - C:\PROGRAMME\ONLINETV2\ONLINETV.EXE O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMME\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAMME\YAHOO!\MESSENGER\YPAGER.EXE O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programme\IrfanView\Ebay\Ebay.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\\mobilemanager.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\\mobilemanager.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\\mobilemanager.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\\mobilemanager.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\mobilemanagerlsp.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\mobilemanagerlsp.dll O10 - Unknown file in Winsock LSP: c:\programme\adisoft ag\mobilemanager client\mobilemanagerlsp.dll O12 - Plugin for .mov: C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\Npqtw32.dll O12 - Plugin for .AVI: C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npavi32.dll O12 - Plugin for .wmv: C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O12 - Plugin for .asx: C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O12 - Plugin for .wvx: C:\PROGRAMME\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll O16 - DPF: {5B5C7640-939C-11D3-A68C-00A0244D4815} (Financepilot) - https://www.financepilot.com/applet/smlpib100.cab O16 - DPF: {75BF09CE-5AAE-4171-8006-633E9CC518BC} (Financepilot eBrokerage) - https://financepilot.mlp.de/TestEBro...mlpebeb100.cab O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...trol_v1-32.cab O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/z...ylomloader.cab O18 - Protocol: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - C:\WINDOWS\SYSTEM\EZTOOL~1.DLL O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\WINDOWS\SYSTEM\HSPPP.DLL O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\WINDOWS\SYSTEM\HSPPP.DLL O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\WINDOWS\SYSTEM\HSPPP.DLL O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - C:\WINDOWS\SYSTEM\HSPPP.DLL ----------------------------------------------------------------- danke |
Themen zu bitte mal anschauen |
askbar, bho, bluescree, bluescreen, computer, defender, desktop, dsl, excel, explorer, firefox, ftp, helper, hijack, hijackthis, home, internet, internet explorer, logfile, mozilla, mozilla firefox, registry, rundll, server, software, system, tuneup utilities, virus, windows |