Aurora Bitte um Hilfe habe schon alles gemacht was ich finden konnte!!

N.S.5 · 11.06.2005, 12:40

Hi All

Habe ein dickes Problem!
Bekomme den Virus Aurora nich weg!
Habe schon alles ausprobiert! (eScan,ABIremover,CCleaner,AntiVir,Sysclean, u.s.w)
Ich kann diese Datein nicht löschen:
C:\DOKUME~1\OUTLAW\LOKALE~1\TEMP\D760\AURORA.EXE
C:\WINDOWS\SVCPROC.EXE
C:\WINDOWS\SYSTEM32\DRPMON.DLL

Ich weiß echt nicht mehr was ich machen soll!!!!

BITTE BITTE UM HILFE

Hier noch die Log:

Logfile of HijackThis v1.99.1
Scan saved at 13:39:19, on 11.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\BlueSoleil\BTNtService.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\MSI\Live Update 3\LMonitor.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
c:\windows\system32\ewkolk.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\games\steam\steam.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\BlueSoleil\BlueSoleil.exe
C:\Programme\MSI\Core Center\CoreCenter.exe
C:\Programme\Common\Bin\WinCinemaMgr.exe
C:\Programme\Teamspeak2Server\server_windows.exe
C:\Programme\Xfire\Xfire.exe
C:\Programme\Teamspeak2_RC2\TeamSpeak.exe
C:\WINDOWS\explorer.exe
C:\Programme\Netscape\Netscp.exe
C:\Dokumente und Einstellungen\Outlaw\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMixerTray] C:\Programme\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [xymkio] c:\windows\system32\ivhddmq.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [ydcmqib] c:\windows\system32\ewkolk.exe r
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - Startup: TeamSpeak 2 Server.lnk = C:\Programme\Teamspeak2Server\server_windows.exe
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: CoreCenter.lnk = C:\Programme\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094400829750
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\BlueSoleil\BTNtService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Programme\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe

The Saint · 11.06.2005, 13:17

@ N.S.5!

Überprüfe diese Dateien

c:\windows\system32\ewkolk.exe
C:\Programme\BlueSoleil\BlueSoleil.exe (wenn nicht bekannt) denke hat was mit dem Handy zu tun.
c:\windows\system32\ivhddmq.exe

bei JOTTI.

Poste uns danach das Ergebniss!

N.S.5 · 11.06.2005, 18:08

HI
1. danke für deine hilfe

2.Diese Dateien gibt es bei mir nicht:
c:\windows\system32\ewkolk.exe
c:\windows\system32\ivhddmq.exe
(weiß auf jeden fall nicht wo die jetzt hin sind

)

3.JO hattes recht C:\Programme\BlueSoleil\BlueSoleil.exe ist ne Bluetooth verbindung zum Handy.

Ich werde noch verrückt mit dem Ding!!!

Die Aktuelle Log:

Logfile of HijackThis v1.99.1
Scan saved at 19:06:32, on 11.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\BlueSoleil\BTNtService.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\MSI\Live Update 3\LMonitor.exe
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\MSN Messenger\MsnMsgr.Exe
c:\windows\system32\enffxs.exe
C:\games\steam\steam.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\BlueSoleil\BlueSoleil.exe
C:\Programme\MSI\Core Center\CoreCenter.exe
C:\Programme\Common\Bin\WinCinemaMgr.exe
C:\Programme\Teamspeak2Server\server_windows.exe
C:\Programme\Xfire\Xfire.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Netscape\Netscp.exe
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programme\Teamspeak2_RC2\TeamSpeak.exe
C:\Dokumente und Einstellungen\Outlaw\Desktop\HijackThis.exe
C:\DOKUME~1\Outlaw\LOKALE~1\Temp\5.tmp\thnall1ac.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMixerTray] C:\Programme\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [xymkio] c:\windows\system32\ivhddmq.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [dvhnru] c:\windows\system32\enffxs.exe r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - Startup: TeamSpeak 2 Server.lnk = C:\Programme\Teamspeak2Server\server_windows.exe
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: CoreCenter.lnk = C:\Programme\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094400829750
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\BlueSoleil\BTNtService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Programme\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe

Rene-gad · 11.06.2005, 18:20

@N.S.5
Bitte
http://download.freenet.de/archiv_s/...troy_4656.html
ftp://ftp.download.com/pub/windows/aawsepersonal.exe
http://forum.hijackthis.de/showthread.php?t=3172
Tools herunterladen, Gebrauchsanletungen lesen, Laufen lassen, danach HJT-Log erstellen, posten.

N.S.5 · 12.06.2005, 09:36

Hi danke auch für deine hilfe!!

Habe deine Anweisungeb befolgt!
Alles runtergeladen und ausgeführt!
Hat sich aber nicht viel verändert sind sogar noch neu infiezirte Datein hinzugekommen:
C:\WINDOWS\YDDMZL.EXE
C:\WINDOWS\SYSTEM32\DRPMON.DLL

Ich kann euch woll noch die Log von Antivir schicken wenn sie euch weiter hilft???

Hier die neue LOG:

Logfile of HijackThis v1.99.1
Scan saved at 10:27:46, on 12.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\MSI\Live Update 3\LMonitor.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\games\steam\steam.exe
c:\windows\system32\szisskx.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\BlueSoleil\BTNtService.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Programme\BlueSoleil\BlueSoleil.exe
C:\Programme\MSI\Core Center\CoreCenter.exe
C:\Programme\Common\Bin\WinCinemaMgr.exe
C:\Programme\Teamspeak2Server\server_windows.exe
C:\Programme\Xfire\Xfire.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Windows Media Player\wmplayer.exe
C:\Programme\Teamspeak2_RC2\TeamSpeak.exe
C:\Dokumente und Einstellungen\Outlaw\Desktop\HijackThis.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMixerTray] C:\Programme\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [xymkio] c:\windows\system32\ivhddmq.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [rvvdrp] c:\windows\system32\szisskx.exe r
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: TeamSpeak 2 Server.lnk = C:\Programme\Teamspeak2Server\server_windows.exe
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: CoreCenter.lnk = C:\Programme\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...67&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094400829750
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\BlueSoleil\BTNtService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Programme\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe

Cidre · 12.06.2005, 10:10

Hallo,

mach mal folgendes:

Lade und entpacke Find It's.zip -> Öffne den Ordner Find-It's und doppelklicke die FindIt's.bat -> nach erfolgten Scan wird das Notepad mit der Auswertung geöffnet -> poste den Inhalt

N.S.5 · 12.06.2005, 12:48

JO hab ich und hier ist das ergebnis!!!

Microsoft Windows XP [Version 5.1.2600]
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidance
If any doubt back them up first

»»»»»»»»»»»»»»»»»»»»»»»» Buddy file's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
»»»»»»»»»»»»»»»»»»»»»»»» SAHAgent Files found »»»»»»»»»»»»»»»»»»»»»»»»»

»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

»»»»» Check for Windows\SYSTEM32\cache32_rtneg* folder.

Datentr„ger in Laufwerk C: ist Zeroone
Volumeseriennummer: B8A8-5DB0

Verzeichnis von C:\WINDOWS\SYSTEM32

»»»»» Checking for SAHAgent ico files.
Datentr„ger in Laufwerk C: ist Zeroone
Volumeseriennummer: B8A8-5DB0

Verzeichnis von C:\WINDOWS\system32

23.03.2005 02:05 20.254 ATI_CUBE.ICO
22.09.2003 00:41 318 omega_drivers.ico
2 Datei(en) 20.572 Bytes
0 Verzeichnis(se), 28.777.725.952 Bytes frei

»»»»»»»»»»»»»»»»»»»»»»»».

HKEY_CURRENT_USER\Software\aurora\AUI3d5OfSDist
HKEY_CURRENT_USER\Software\aurora\AUI3d5OfSInst
HKEY_CURRENT_USER\Software\aurora\AUC3n5trMsgSDisp
HKEY_CURRENT_USER\Software\aurora\AUs3t5icky1S
HKEY_CURRENT_USER\Software\aurora\AUs3t5icky2S
HKEY_CURRENT_USER\Software\aurora\AUs3t5icky3S
HKEY_CURRENT_USER\Software\aurora\AUs3t5icky4S
HKEY_CURRENT_USER\Software\aurora\AUC1o3d5eOfSFinalAd
HKEY_CURRENT_USER\Software\aurora\AUT3i5m7eOfSFinalAd
HKEY_CURRENT_USER\Software\aurora\AUD3s5tSSEnd
HKEY_CURRENT_USER\Software\aurora\AU3N5a7tionSCode
HKEY_CURRENT_USER\Software\aurora\AUP3D5om
HKEY_CURRENT_USER\Software\aurora\AUT3h5rshSCheckSIn
HKEY_CURRENT_USER\Software\aurora\AUT3h5rshSMots
HKEY_CURRENT_USER\Software\aurora\AUM3o5deSSync
HKEY_CURRENT_USER\Software\aurora\AUI3n5ProgSCab
HKEY_CURRENT_USER\Software\aurora\AUI3n5ProgSEx
HKEY_CURRENT_USER\Software\aurora\AUI3n5ProgSLstest
HKEY_CURRENT_USER\Software\aurora\AUB3D5om
HKEY_CURRENT_USER\Software\aurora\AUE3v5nt
HKEY_CURRENT_USER\Software\aurora\AUT3h5rshSBath
HKEY_CURRENT_USER\Software\aurora\AUT3h5rshSysSInf
HKEY_CURRENT_USER\Software\aurora\AUL3n5Title
HKEY_CURRENT_USER\Software\aurora\AUC3u5rrentSMode
HKEY_CURRENT_USER\Software\aurora\AUC3n5tFyl
HKEY_CURRENT_USER\Software\aurora\AUI3g5noreS
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon\Driver
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon\Driver

Cidre · 12.06.2005, 13:32

Lade und aktualsiere eScan AntiVirus.
Lade Killbox und wende es später, wie beschrieben an und beende den TeaTimer von Spybot S&D.

Deinstalliere nun über Systemsteuerung -> Software 'Aurora'.
Start -> Ausführen -> services.msc -> OK -> Rechtsklick auf System Startup Service (SvcProc) -> Eigenschaften -> "Starttyp" deaktiviert und "Dienststatus" beenden einstellen -> Übernehmen
Wechsle in den abgesicherten Modus und fixe diese Einträge (Haken setzen und auf Fix Checked klicken):

Zitat:

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [xymkio] c:\windows\system32\ivhddmq.exe
O4 - HKLM\..\Run: [rvvdrp] c:\windows\system32\szisskx.exe r
Alle O15 und O16
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Scanne mit eScan, lösche die gefundene Malware und auch die u.g Dateien mit Hilfe von KillBox:

C:\WINDOWS\Nail.exe
c:\windows\system32\ivhddmq.exe
c:\windows\system32\szisskx.exe r
C:\WINDOWS\YDDMZL.EXE
C:\WINDOWS\SYSTEM32\DRPMON.DLL

neues Log-File von HijackThis und die Virus Log Information von eScan posten.

N.S.5 · 13.06.2005, 19:25

HI

SO!!! hab alles gemacht wie du es mir beschrieben hast.
Einiges ist mit in der LOG aufgefallen und zwar das solche datein immer wieder auftauchen aber immer einen anderen namen habe:

O4 - HKLM\..\Run: [iuidic] c:\windows\system32\bofvjs.exe r

und es ist auf jeden fall besser geworden aber ich glaube nicht das es "ganz sauer" ist.

was kann ich noch machen???

PS: Sorry das es so lange gedauert hat bin Soldat und habe fast nur am wochen ende für so was zeit!!!!

Logfile of HijackThis v1.99.1
Scan saved at 20:18:24, on 13.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LXSUPMON.EXE
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\MSI\Live Update 3\LMonitor.exe
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\games\steam\steam.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\BlueSoleil\BlueSoleil.exe
C:\Programme\MSI\Core Center\CoreCenter.exe
C:\Programme\Common\Bin\WinCinemaMgr.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\Xfire\Xfire.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\BlueSoleil\BTNtService.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe
C:\Programme\Maya 6.0 Personal Learning Edition\docs\jre\bin\java.exe
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Outlaw\Desktop\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMixerTray] C:\Programme\NVIDIA Corporation\NvMixer\NvMixerTray.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iuidic] c:\windows\system32\bofvjs.exe r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: CoreCenter.lnk = C:\Programme\MSI\Core Center\CoreCenter.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\BlueSoleil\BTNtService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Maya 6 PLE Documentation Server (mple6docserver) - Unknown owner - C:\Programme\Maya 6.0 Personal Learning Edition\docs\wrapper.exe" -s "C:\Programme\Maya 6.0 Personal Learning Edition\docs\Wrapper.conf (file missing)
O23 - Service: MySql - Unknown owner - C:/mysql/bin/mysqld-nt.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe

Cidre · 13.06.2005, 19:52

Hallo N.S.5,

dein Log-File sieht doch schon um einiges besser aus.

Fixe nochmals diese Einträge:
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iuidic] c:\windows\system32\bofvjs.exe r

Ggf. die c:\windows\system32\bofvjs.exe nochmal löschen, falls noch nicht geschehen.

Abschließend solltest die mwav.log löschen, nochmals mit eScan scannen und die Virus Log Information posten.

N.S.5 · 14.06.2005, 17:30

HI da bin ich wieder!!!

So ich kann diese datei nicht Löschen nach dem Fixen kommen sie SOFORT wieder:

O4 - HKLM\..\Run: [iuidic] c:\windows\system32\bofvjs.exe r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

und hier ist die Virus Log von eScan (sieht aber auch nich so gut aus)

Object "SideFind Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ElitebarBHO Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "HyperBar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ISearchTech.ISTdownloader Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\asinst.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\system32\LegitCheckControl.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Common\Bin\IVIPromotion.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\pxwma.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\FileGrp\Msvcrt10.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe\Photoshop Album\Kataloge\My Catalog.psa". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Games\Far Cry\Shaders\HWScripts\Declarations\CGPShaders\Cache\do_not_delete_this_folder.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Games\Far Cry\Shaders\HWScripts\Declarations\CGVShaders\Cache\do_not_delete_this_folder.txt". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\SymNeti.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\LegitCheckControl.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\asinst.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0482DDE0-7817-11cf-8A03-00AA006ECB65}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{05589f80-c356-11ce-bf01-00aa0055595a}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0DED49D5-A8B7-4d5d-97A1-12B0C195874D}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{0F69997F-69A2-4B3B-9CE8-A06DCE657EB1}" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\DW22CC.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}" refers to invalid object "D:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}" refers to invalid object "kstvtune.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}" refers to invalid object "kstvtune.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{29FF67FF-8050-480f-9F30-CC41635F2F9D}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}" refers to invalid object "D:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{442D12A1-2641-11d2-90FB-006008A1F441}" refers to invalid object "a3d.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{6A2E0670-28E4-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{70B51430-B6CA-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "ksxbar.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "ksxbar.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "ksxbar.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "ksxbar.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96464-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96465-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96466-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{71F96467-78F3-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{72F89B75-654C-4F47-9C3B-938C0248D6DD}" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\DW22CC.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{8298d101-f992-43b7-8eca-5052d885b995}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{92FA2C24-253C-11d2-90FB-006008A1F441}" refers to invalid object "a3dapi.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9E936C4C-2798-4003-8913-F7E6723480F6}" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\DW22CC.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A5CF2D91-1749-41DE-BE78-3B6633E0C07D}" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\DW22CE.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A6FF2A54-2DB3-4843-855F-607F3BF39B57}" refers to invalid object "C:\DOKUME~1\Outlaw\LOKALE~1\Temp\DW22CC.tmp". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{A9E69612-B80D-11D0-B9B9-00A0C922E750}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}" refers to invalid object "D:\PROGRAM\32\mci32.ocx". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6E13343-30AC-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6E13344-30AC-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6E13350-30AC-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6E13360-30AC-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{C6E13370-30AC-11d0-A18C-00A0C9118956}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{d8f1eee0-f634-11cf-8700-00a0245d918b}" refers to invalid object "a3d.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f612954d-3b0b-4c56-9563-227b7be624b4}" refers to invalid object "ADMWPROX.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{f72a76A0-eb0a-11d0-ace4-0000c0cc16ba}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{F72A76E0-EB0A-11d0-ACE4-0000C0CC16BA}" refers to invalid object "kswdmcap.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{FD0A5AF3-B41D-11d2-9C95-00C04F7971E0}" refers to invalid object "BdaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.
Entry "HKCR\WMPShell.HWEventHandler.1" refers to invalid object "{9B186A8F-F520-4eeb-B553-118304AC46C5}". Action Taken: No Action Taken.

12.06.2005, 10:10	#6
Cidre Administrator, a.D.	Aurora Bitte um Hilfe habe schon alles gemacht was ich finden konnte!! Hallo, mach mal folgendes: Lade und entpacke Find It's.zip -> Öffne den Ordner Find-It's und doppelklicke die FindIt's.bat -> nach erfolgten Scan wird das Notepad mit der Auswertung geöffnet -> poste den Inhalt __________________ --> Aurora Bitte um Hilfe habe schon alles gemacht was ich finden konnte!!

Aurora Bitte um Hilfe habe schon alles gemacht was ich finden konnte!!

Log-Analyse und Auswertung: Aurora Bitte um Hilfe habe schon alles gemacht was ich finden konnte!!