Hallo!
Ich glaube dass ich einen Virus oder ähnliches habe, der jedoch nicht von Adaware, Spybot S&D und Norman entdeckt bzw. entfernt werden kann.
Ich bitte euch um Hilfe bei der Auswertung des Logs.
Vielen Dank im Voraus!
Hier der HJT Log
("http" => "h**p"):
Zitat:
Logfile of HijackThis v1.99.1
Scan saved at 06:17:07, on 03.08.05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\NORMAN\BIN\ZANDA.EXE
C:\PROGRAMME\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\NORMAN\NVC\BIN\CCLAW.EXE
C:\NORMAN\NVC\BIN\NVCSCHED.EXE
C:\NORMAN\NVC\BIN\NIP.EXE
C:\NORMAN\BIN\NJEEVES.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\NORMAN\BIN\ZLH.EXE
C:\WINDOWS\SHUTDOWNAWARE.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAMME\TOOLS\AUTOEJECT\AUTOEJCT.EXE
C:\PROGRAMME\CLIPMT40\CLIPMT40.EXE
C:\PROGRAMME\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAMME\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://192.168.1.1/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {EFA3A54F-35F6-4A2F-DA2B-3DE67C885ACD} - C:\WINDOWS\SYSTEM\DFVI.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [NPROTECT] C:\Programme\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [Shutdownaware] C:\WINDOWS\Shutdownaware.exe
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Norman ZANDA] "C:\NORMAN\BIN\ZANDA.EXE" /LOAD
O4 - HKLM\..\RunServices: [NPROTECT] C:\Programme\Norton Utilities\NPROTECT.EXE
O4 - Startup: Verknüpfung mit Autoejct.exe.lnk = C:\Programme\Tools\Autoeject\AUTOEJCT.EXE
O4 - Startup: Clipmate.lnk = C:\Programme\clipmt40\CLIPMT40.exe
O4 - Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: [ IK-Spiobericht hochladen ] - C:\Programme\Cloak And Dagger\loader.js
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O12 - Plugin for .php: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.heise.de
O15 - Trusted Zone: *.compuserve.de
O15 - Trusted Zone: *.puretec.de
O15 - Trusted Zone: *.1und1.com
O15 - Trusted Zone: *.closeup.de
O15 - Trusted Zone: *.gamestar.de
O15 - Trusted Zone: *.spinchat.de
O15 - Trusted Zone: *.google.de
O15 - Trusted Zone: *.planspiel-boerse.de
O15 - Trusted Zone: *.web.de
O15 - Trusted Zone: *.homestarrunner.com
O15 - Trusted Zone: *.tagesschau.de
O15 - Trusted Zone: *.empireuniverse.de
O15 - Trusted Zone: *.inselkampf.de
O15 - Trusted Zone: *.ubisoft.de
O15 - Trusted Zone: *.gmx.de
O15 - Trusted Zone: *.gmx.net
O15 - Trusted Zone: *.die-x-tremen.de.vu
O15 - Trusted Zone: *.thewall.de
O15 - Trusted Zone: *.sxload.com
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O15 - ProtocolDefaults: 'h**p' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'h**p' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - h**p://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - h**p://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - h**p://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - h**p://xtraz.icq.com/xtraz/activex/MISBH.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - h**p://playroom.icq.com/odyssey_web11.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - h**p://arcade.icq.com/carlo/zuma/popcaploader_v5.cab
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - h**p://s09.picserver.info/upload/ImageUploader3.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - h**p://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {10000000-1000-0000-1000-000000000000} - mhtml:file://C:\ARCHIVE.MHT!h**p://myfotoalbum.biz/msits.exe
|
17.08.2005, 12:34
Baum-Darstellung