|
Log-Analyse und Auswertung: Hijacker......will auf Nummer sicher gehen 3Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.03.2005, 00:33 | #1 |
| Hijacker......will auf Nummer sicher gehen 3 O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe O4 - HKLM\..\Run: [Digital Dashboard] C:\Program Files\Compaq\Digital Dashboard\DevGulp.exe O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [CompaqSysTray] cpqpscp.exe O4 - HKLM\..\Run: [cqscp2ps.exe] C:\WINDOWS\SYSTEM\cqscp2ps.exe O4 - HKLM\..\Run: [LexStart] Lexstart.exe O4 - HKLM\..\Run: [SHPC32] shpc32.exe O4 - HKLM\..\Run: [CQSCP2PSERVER] CQSCP2PS.EXE O4 - HKLM\..\Run: [abtu] C:\WINDOWS\APPLIC~1\lopsearch.exe -QuieT O4 - HKLM\..\Run: [MediaLoads Installer] "C:\Program Files\DownloadWare\dw.exe" /H O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE O4 - HKLM\..\Run: [WhenUSave] C:\PROGRA~1\SAVE\Save.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [MotiveMonitor] C:\Program Files\Motive\motmon.exe O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [LVComs] C:\WINDOWS\SYSTEM\LVComS.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKLM\..\Run: [Iof] C:\WINDOWS\Ime.exe O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\SYSTEM\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [bREb] C:\WINDOWS\YKRQXDDX.EXE O4 - HKLM\..\Run: [Tlp] C:\WINDOWS\Ggn.exe O4 - HKLM\..\Run: [Kpb] C:\WINDOWS\SYSTEM\Jlf.exe O4 - HKLM\..\Run: [Oqi] C:\WINDOWS\SYSTEM\Qse.exe O4 - HKLM\..\Run: [Hvi] C:\WINDOWS\SYSTEM\Udg.exe O4 - HKLM\..\Run: [AdTools Service] C:\PROGRAM FILES\ADTOOLS SERVICE\ADTOOLS.EXE O4 - HKLM\..\Run: [Lbi] C:\WINDOWS\SYSTEM\Rmh.exe O4 - HKLM\..\Run: [Glv] C:\WINDOWS\SYSTEM\Oev.exe O4 - HKLM\..\Run: [Ogj] C:\WINDOWS\Fln.exe O4 - HKLM\..\Run: [Sge] C:\WINDOWS\SYSTEM\Egu.exe O4 - HKLM\..\Run: [Oot] C:\WINDOWS\Rna.exe O4 - HKLM\..\Run: [Cpf] C:\WINDOWS\Rdd.exe O4 - HKLM\..\Run: [Gst] C:\WINDOWS\SYSTEM\Cik.exe O4 - HKLM\..\Run: [Fji] C:\WINDOWS\Krc.exe O4 - HKLM\..\Run: [Eum] C:\WINDOWS\Dvs.exe O4 - HKLM\..\Run: [Dqa] C:\WINDOWS\SYSTEM\Leu.exe O4 - HKLM\..\Run: [Chn] C:\WINDOWS\SYSTEM\Kte.exe O4 - HKLM\..\Run: [Aib] C:\WINDOWS\Vqe.exe O4 - HKLM\..\Run: [Emg] C:\WINDOWS\SYSTEM\Dif.exe O4 - HKLM\..\Run: [Tof] C:\WINDOWS\SYSTEM\Blq.exe O4 - HKLM\..\Run: [Rfv] C:\WINDOWS\Ihm.exe O4 - HKLM\..\Run: [Hotbar] C:\Program Files\Hotbar\Bin\4.6.1.0\HbOEAddOn.exe O4 - HKLM\..\Run: [WeatherOnTray] C:\PROGRAM FILES\HOTBAR\BIN\4.6.1.0\WEATHERONTRAY.EXE O4 - HKLM\..\Run: [orrialba] C:\WINDOWS\SYSTEM\pspwzydc.exe O4 - HKLM\..\Run: [Kmq] C:\WINDOWS\SYSTEM\Oto.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [Iof] C:\WINDOWS\Ime.exe O4 - HKCU\..\Run: [Tlp] C:\WINDOWS\Ggn.exe O4 - HKCU\..\Run: [Kpb] C:\WINDOWS\SYSTEM\Jlf.exe O4 - HKCU\..\Run: [Oqi] C:\WINDOWS\SYSTEM\Qse.exe O4 - HKCU\..\Run: [Hvi] C:\WINDOWS\SYSTEM\Udg.exe O4 - HKCU\..\Run: [Lbi] C:\WINDOWS\SYSTEM\Rmh.exe O4 - HKCU\..\Run: [Glv] C:\WINDOWS\SYSTEM\Oev.exe O4 - HKCU\..\Run: [Ogj] C:\WINDOWS\Fln.exe O4 - HKCU\..\Run: [Sge] C:\WINDOWS\SYSTEM\Egu.exe O4 - HKCU\..\Run: [Oot] C:\WINDOWS\Rna.exe O4 - HKCU\..\Run: [Cpf] C:\WINDOWS\Rdd.exe O4 - HKCU\..\Run: [Gst] C:\WINDOWS\SYSTEM\Cik.exe O4 - HKCU\..\Run: [Fji] C:\WINDOWS\Krc.exe O4 - HKCU\..\Run: [Eum] C:\WINDOWS\Dvs.exe O4 - HKCU\..\Run: [Dqa] C:\WINDOWS\SYSTEM\Leu.exe O4 - HKCU\..\Run: [Chn] C:\WINDOWS\SYSTEM\Kte.exe O4 - HKCU\..\Run: [Aib] C:\WINDOWS\Vqe.exe O4 - HKCU\..\Run: [Emg] C:\WINDOWS\SYSTEM\Dif.exe O4 - HKCU\..\Run: [Tof] C:\WINDOWS\SYSTEM\Blq.exe O4 - HKCU\..\Run: [Rfv] C:\WINDOWS\Ihm.exe O4 - HKCU\..\Run: [Kmq] C:\WINDOWS\SYSTEM\Oto.exe O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe O4 - Startup: A1000 Settings Utility.lnk = C:\Program Files\Compaq\A1000\CPQA1000.exe O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Startup: America Online 5.0 Tray Icon.lnk = C:\America Online 5.0a\aoltray.exe O4 - Startup: PowerReg Scheduler.exe O4 - Startup: Compaq Knowledge Center.lnk = C:\Program Files\Compaq Knowledge Center\bin\silent.exe O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=3c00&LC=0409 (file missing) O9 - Extra button: Print Favorites - {BA224D00-9553-11d2-9D65-00A0CC22CBC4} - C:\Program Files\Compaq\A1000\prnfavs.exe O9 - Extra 'Tools' menuitem: Print &Favorites... - {BA224D00-9553-11d2-9D65-00A0CC22CBC4} - C:\Program Files\Compaq\A1000\prnfavs.exe O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0411.DLL O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O12 - Plugin for .swf: C:\Program Files\Netscape\Communicator\Program\PLUGINS\npswf32.dll O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.skoobidoo.com O15 - Trusted Zone: *.my-internet.info |
08.03.2005, 00:44 | #2 |
| Hijacker......will auf Nummer sicher gehen 3__________________
__________________ |
Themen zu Hijacker......will auf Nummer sicher gehen 3 |
.dll, .inf, button, c:\windows, cmd, desktop, digital, dll, file missing, internet, links, live, messenger, microsoft, msn messenger, netscape, online, rundll, rundll32, rundll32.exe, services, system, this, web, windows, yahoo, zone |