Halli,
habe das problem das sich nach einer windowsneuinstallation irgendwas in meinem pc eingenistet hat was ich nicht mehr entfernt bekomm.
antivir meldet mit obengenannten trojaner der sich in einer .cab datei befinden soll , was heisst er lässt sih mit antivir nicht entfernen. es öffnen sich ständig browserfenster. habs mit etlichen anti-spyware-progs etc schon probiert, leider ohne erfolg


MfG Lani

Hallo,

poste bitte mal ein HijackThis-Log.

Logfile of HijackThis v1.99.1
Scan saved at 18:38:26, on 19.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Programme\AVPersonal\AVGUARD.EXE
d:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\explorer.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Lani\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=explorer.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://h**p://promo.dollarrevenue.co...rtload114a.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://h**p://update.microsoft.com/w...?1132358055776
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://h**p://static.zangocash.com/c...bridge-c18.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2DD65DBE-A8EB-46C7-B334-97CFD3DA24D0}: NameServer = 217.237.149.225 194.25.2.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0433480-4439-46ED-B880-71DD78CE0EC4}: NameServer = 141.48.18.1
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\f2l0lc3m1f.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - d:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - d:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

hm hab die links umgeändert allerdings wollte es nicht so wie ich wollt *grübel*

Führe davon die erste Option aus und poste das Log. Ansonsten noch nichts machen.

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnce]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\enpml1711.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT-AUTORITŽT\SYSTEM
(IO) ALLOW Full access NT-AUTORITŽT\SYSTEM
(NI) ALLOW Full access NT-AUTORITŽT\SYSTEM
(IO) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-NI) ALLOW Read VORDEFINIERT\Benutzer
(ID-IO) ALLOW Read VORDEFINIERT\Benutzer
(ID-NI) ALLOW Read VORDEFINIERT\Hauptbenutzer
(ID-IO) ALLOW Read VORDEFINIERT\Hauptbenutzer
(ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM
(ID-NI) ALLOW Full access VORDEFINIERT\Administratoren
(ID-IO) ALLOW Full access ERSTELLER-BESITZER

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C232A83B-7434-3ABF-F7BC-BA28E94094F2}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Eigenschaften f�r Multimediadatei"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-Scannerverwaltung"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS-Sicherheit"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE-Eigenschaftenseite f�r Dokumente"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shellerweiterungen f�r Freigaben"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung f�r Grafikkarten"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung f�r Bildschirme"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung f�r Anzeigeverschiebung"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS-Sicherheit"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilit„tsseite"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell-Datenauszughandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Erweiterung f�r Datentr„gerkopien"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shellerweiterungen f�r Microsoft Windows-Netzwerkobjekte"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-Monitorverwaltung"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-Druckerverwaltung"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shellerweiterungen f�r die Dateikomprimierung"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Shellerweiterung f�r Webdrucker"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontextmen� f�r die Verschl�sselung"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Aktenkoffer"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Erweiterung f�r HyperTerminal-Icons"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Schriftarten"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-Profil"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Druckersicherheit"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shellerweiterungen f�r Freigaben"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Krypto-PKO-Erweiterung"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Krypto-Sign-Erweiterung"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netzwerkverbindungen"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netzwerkverbindungen"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanner und Kameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanner und Kameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanner und Kameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanner und Kameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanner und Kameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shellerweiterungen f�r Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Datenverkn�pfung"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplante Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskleiste und Startmen�"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Suchen"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hilfe und Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hilfe und Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ausf�hren..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-Mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Schriftarten"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Verwaltung"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Syntaxanalyse der Adressleiste"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft URL-Verlauf-Dienst"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Verlauf"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Sucheingriff"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-Begr�áungsbildschirm"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX-Cacheordner"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ Dateiminiaturansicht-Extrahierungsprogramm"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Zusammenfassungs-Miniaturansichthandler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML-Extrahierungsprogramm"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Webpublishing-Assistent"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestellung von Abz�gen �ber das Internet"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shellobjekt des Webpublishing-Assistenten"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Passport-Assistent"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Benutzerkonten"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channeldatei"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channelverkn�pfung"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channelhandlerobjekt"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Ordner 'Offlinedateien'"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Nach Personen..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{3093A194-4604-4FE4-8320-0BB79AAD6072}"=""
"{00C29BC1-52F8-49D7-8743-CB58A493C6BF}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3093A194-4604-4FE4-8320-0BB79AAD6072}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3093A194-4604-4FE4-8320-0BB79AAD6072}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3093A194-4604-4FE4-8320-0BB79AAD6072}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3093A194-4604-4FE4-8320-0BB79AAD6072}\InprocServer32]
@="C:\\WINDOWS\\system32\\mutime.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{00C29BC1-52F8-49D7-8743-CB58A493C6BF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{00C29BC1-52F8-49D7-8743-CB58A493C6BF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{00C29BC1-52F8-49D7-8743-CB58A493C6BF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{00C29BC1-52F8-49D7-8743-CB58A493C6BF}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Sat 3 Sep 2005 0:53:20 A.... 1.019.904 996,00 K
cdfview.dll Sat 3 Sep 2005 0:53:20 A.... 152.064 148,50 K
cdosys.dll Sat 10 Sep 2005 2:54:28 A.... 2.067.968 1,97 M
danim.dll Sat 3 Sep 2005 0:53:20 A.... 1.055.744 1,00 M
divx.dll Wed 28 Sep 2005 22:29:14 A.... 693.248 677,00 K
divx_x~1.dll Wed 28 Sep 2005 22:29:12 A.... 688.128 672,00 K
divx_x~2.dll Wed 28 Sep 2005 22:29:12 A.... 688.128 672,00 K
divx_x~3.dll Wed 28 Sep 2005 22:29:12 A.... 671.744 656,00 K
dpl100.dll Thu 27 Oct 2005 20:37:46 A.... 86.016 84,00 K
dpu10.dll Thu 27 Oct 2005 20:37:44 A.... 294.912 288,00 K
dpu11.dll Thu 27 Oct 2005 20:37:44 A.... 294.912 288,00 K
dpugui10.dll Thu 27 Oct 2005 20:37:48 A.... 53.248 52,00 K
dpugui11.dll Thu 27 Oct 2005 20:37:46 A.... 593.920 580,00 K
dpus11.dll Thu 27 Oct 2005 20:37:44 A.... 339.968 332,00 K
dpv11.dll Thu 27 Oct 2005 20:37:44 A.... 57.344 56,00 K
dtu100.dll Thu 27 Oct 2005 20:37:44 A.... 200.704 196,00 K
dxtrans.dll Sat 3 Sep 2005 0:53:22 A.... 205.312 200,50 K
enpml1~1.dll Sun 20 Nov 2005 0:01:20 ..S.R 234.787 229,28 K
event97.dll Sun 20 Nov 2005 0:02:36 ..S.R 234.787 229,28 K
extmgr.dll Sat 3 Sep 2005 0:53:22 ..... 55.808 54,50 K
g804li~1.dll Sun 20 Nov 2005 15:21:06 ..S.R 236.195 230,66 K
gdi32.dll Thu 6 Oct 2005 4:18:12 A.... 280.064 273,50 K
iepeers.dll Sat 3 Sep 2005 0:53:22 A.... 251.392 245,50 K
inseng.dll Sat 3 Sep 2005 0:53:22 A.... 96.768 94,50 K
j2j6lc~1.dll Sat 19 Nov 2005 16:24:40 ..S.R 236.271 230,73 K
jt0407~1.dll Sun 20 Nov 2005 15:09:24 ..S.R 235.194 229,68 K
l4n4le~1.dll Sun 20 Nov 2005 15:07:34 ..S.R 236.241 230,70 K
legitc~1.dll Fri 4 Nov 2005 16:27:24 A.... 534.280 521,76 K
libdivx.dll Wed 28 Sep 2005 19:50:06 A.... 1.044.480 1020,00 K
linkinfo.dll Thu 1 Sep 2005 2:44:42 A.... 19.968 19,50 K
mbutb.dll Sun 20 Nov 2005 15:07:34 ..S.R 234.787 229,28 K
mdv1_0.dll Sat 19 Nov 2005 19:02:20 ..S.R 234.787 229,28 K
mn43dmod.dll Sat 19 Nov 2005 18:29:28 ..S.R 234.787 229,28 K
mshtml.dll Tue 4 Oct 2005 17:26:02 A.... 3.013.120 2,87 M
mshtmled.dll Sat 3 Sep 2005 0:53:22 A.... 448.512 438,00 K
msrating.dll Sat 3 Sep 2005 0:53:22 A.... 146.432 143,00 K
mstime.dll Sat 3 Sep 2005 0:53:22 A.... 530.432 518,00 K
mutime.dll Sun 20 Nov 2005 15:21:06 ..S.R 234.787 229,28 K
nv4_disp.dll Fri 4 Nov 2005 18:03:00 A.... 3.924.096 3,74 M
nvapi.dll Fri 4 Nov 2005 18:03:00 A.... 86.016 84,00 K
nvcod.dll Fri 4 Nov 2005 18:03:00 A.... 35.328 34,50 K
nvcodins.dll Fri 4 Nov 2005 18:03:00 A.... 35.328 34,50 K
nvcpl.dll Fri 4 Nov 2005 18:03:00 A.... 7.307.264 6,97 M
nvhwvid.dll Fri 4 Nov 2005 18:03:00 A.... 573.440 560,00 K
nview.dll Fri 4 Nov 2005 18:03:00 A.... 1.466.368 1,40 M
nvmccs.dll Fri 4 Nov 2005 18:03:00 A.... 229.376 224,00 K
nvmccsrs.dll Fri 4 Nov 2005 18:03:00 A.... 45.056 44,00 K
nvmctray.dll Fri 4 Nov 2005 18:03:00 A.... 86.016 84,00 K
nvnt4cpl.dll Fri 4 Nov 2005 18:03:00 A.... 286.720 280,00 K
nvoglnt.dll Fri 4 Nov 2005 18:03:00 A.... 5.394.432 5,14 M
nvrsar.dll Fri 4 Nov 2005 18:03:00 A.... 319.488 312,00 K
nvrscs.dll Fri 4 Nov 2005 18:03:00 A.... 241.664 236,00 K
nvrsda.dll Fri 4 Nov 2005 18:03:00 A.... 245.760 240,00 K
nvrsde.dll Fri 4 Nov 2005 18:03:00 A.... 270.336 264,00 K
nvrsel.dll Fri 4 Nov 2005 18:03:00 A.... 274.432 268,00 K
nvrseng.dll Fri 4 Nov 2005 18:03:00 A.... 241.664 236,00 K
nvrses.dll Fri 4 Nov 2005 18:03:00 A.... 274.432 268,00 K
nvrsesm.dll Fri 4 Nov 2005 18:03:00 A.... 266.240 260,00 K
nvrsfi.dll Fri 4 Nov 2005 18:03:00 A.... 241.664 236,00 K
nvrsfr.dll Fri 4 Nov 2005 18:03:00 A.... 278.528 272,00 K
nvrshe.dll Fri 4 Nov 2005 18:03:00 A.... 319.488 312,00 K
nvrshu.dll Fri 4 Nov 2005 18:03:00 A.... 253.952 248,00 K
nvrsit.dll Fri 4 Nov 2005 18:03:00 A.... 274.432 268,00 K
nvrsja.dll Fri 4 Nov 2005 18:03:00 A.... 258.048 252,00 K
nvrsko.dll Fri 4 Nov 2005 18:03:00 A.... 253.952 248,00 K
nvrsnl.dll Fri 4 Nov 2005 18:03:00 A.... 266.240 260,00 K
nvrsno.dll Fri 4 Nov 2005 18:03:00 A.... 249.856 244,00 K
nvrspl.dll Fri 4 Nov 2005 18:03:00 A.... 249.856 244,00 K
nvrspt.dll Fri 4 Nov 2005 18:03:00 A.... 266.240 260,00 K
nvrsptb.dll Fri 4 Nov 2005 18:03:00 A.... 262.144 256,00 K
nvrsru.dll Fri 4 Nov 2005 18:03:00 A.... 262.144 256,00 K
nvrssk.dll Fri 4 Nov 2005 18:03:00 A.... 249.856 244,00 K
nvrssl.dll Fri 4 Nov 2005 18:03:00 A.... 249.856 244,00 K
nvrssv.dll Fri 4 Nov 2005 18:03:00 A.... 245.760 240,00 K
nvrstr.dll Fri 4 Nov 2005 18:03:00 A.... 249.856 244,00 K
nvrszhc.dll Fri 4 Nov 2005 18:03:00 A.... 217.088 212,00 K
nvrszht.dll Fri 4 Nov 2005 18:03:00 A.... 118.784 116,00 K
nvshell.dll Fri 4 Nov 2005 18:03:00 A.... 466.944 456,00 K
nvwddi.dll Fri 4 Nov 2005 18:03:00 A.... 81.920 80,00 K
nvwdmcpl.dll Fri 4 Nov 2005 18:03:00 A.... 1.662.976 1,59 M
nvwimg.dll Fri 4 Nov 2005 18:03:00 A.... 1.019.904 996,00 K
nvwrsar.dll Fri 4 Nov 2005 18:03:00 A.... 282.624 276,00 K
nvwrscs.dll Fri 4 Nov 2005 18:03:00 A.... 286.720 280,00 K
nvwrsda.dll Fri 4 Nov 2005 18:03:00 A.... 294.912 288,00 K
nvwrsde.dll Fri 4 Nov 2005 18:03:00 A.... 311.296 304,00 K
nvwrsel.dll Fri 4 Nov 2005 18:03:00 A.... 335.872 328,00 K
nvwrseng.dll Fri 4 Nov 2005 18:03:00 A.... 286.720 280,00 K
nvwrses.dll Fri 4 Nov 2005 18:03:00 A.... 335.872 328,00 K
nvwrsesm.dll Fri 4 Nov 2005 18:03:00 A.... 327.680 320,00 K
nvwrsfi.dll Fri 4 Nov 2005 18:03:00 A.... 303.104 296,00 K
nvwrsfr.dll Fri 4 Nov 2005 18:03:00 A.... 327.680 320,00 K
nvwrshe.dll Fri 4 Nov 2005 18:03:00 A.... 278.528 272,00 K
nvwrshu.dll Fri 4 Nov 2005 18:03:00 A.... 315.392 308,00 K
nvwrsit.dll Fri 4 Nov 2005 18:03:00 A.... 323.584 316,00 K
nvwrsja.dll Fri 4 Nov 2005 18:03:00 A.... 212.992 208,00 K
nvwrsko.dll Fri 4 Nov 2005 18:03:00 A.... 196.608 192,00 K
nvwrsnl.dll Fri 4 Nov 2005 18:03:00 A.... 319.488 312,00 K
nvwrsno.dll Fri 4 Nov 2005 18:03:00 A.... 299.008 292,00 K
nvwrspl.dll Fri 4 Nov 2005 18:03:00 A.... 294.912 288,00 K
nvwrspt.dll Fri 4 Nov 2005 18:03:00 A.... 323.584 316,00 K
nvwrsptb.dll Fri 4 Nov 2005 18:03:00 A.... 319.488 312,00 K
nvwrsru.dll Fri 4 Nov 2005 18:03:00 A.... 315.392 308,00 K
nvwrssk.dll Fri 4 Nov 2005 18:03:00 A.... 299.008 292,00 K
nvwrssl.dll Fri 4 Nov 2005 18:03:00 A.... 303.104 296,00 K
nvwrssv.dll Fri 4 Nov 2005 18:03:00 A.... 294.912 288,00 K
nvwrstr.dll Fri 4 Nov 2005 18:03:00 A.... 303.104 296,00 K
nvwrszhc.dll Fri 4 Nov 2005 18:03:00 A.... 163.840 160,00 K
nvwrszht.dll Fri 4 Nov 2005 18:03:00 A.... 167.936 164,00 K
pngfilt.dll Sat 3 Sep 2005 0:53:22 A.... 39.424 38,50 K
px.dll Wed 14 Sep 2005 20:17:44 ..... 462.848 452,00 K
pxdrv.dll Wed 14 Sep 2005 20:17:44 ..... 319.488 312,00 K
pxmas.dll Wed 14 Sep 2005 20:17:44 ..... 143.360 140,00 K
pxwave.dll Wed 14 Sep 2005 20:17:44 ..... 286.720 280,00 K
quartz.dll Tue 30 Aug 2005 4:55:36 A.... 1.292.800 1,23 M
shdocvw.dll Sat 3 Sep 2005 0:53:22 A.... 1.484.288 1,41 M
shell32.dll Fri 23 Sep 2005 4:06:22 A.... 8.491.520 8,10 M
shlwapi.dll Sat 3 Sep 2005 0:53:22 A.... 474.112 463,00 K
ssldivx.dll Wed 28 Sep 2005 19:50:04 A.... 200.704 196,00 K
szhcinst.dll Sun 20 Nov 2005 15:09:24 ..S.R 234.787 229,28 K
umpnpmgr.dll Tue 23 Aug 2005 4:39:58 A.... 124.416 121,50 K
urlmon.dll Sat 3 Sep 2005 0:53:22 A.... 605.696 591,50 K
vxblock.dll Wed 14 Sep 2005 20:17:44 ..... 28.672 28,00 K
wininet.dll Sat 3 Sep 2005 0:53:22 A.... 664.064 648,50 K
winsrv.dll Thu 1 Sep 2005 2:44:44 A.... 292.352 285,50 K

124 items found: 124 files (11 H/S), 0 directories.
Total of file sizes: 70.508.698 bytes 67,24 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Datentr„ger in Laufwerk C: ist System
Volumeseriennummer: 94F4-E4E9

Verzeichnis von C:\WINDOWS\System32

20.11.2005 15:21 234.787 mutime.dll
20.11.2005 15:21 236.195 g804lidq180e.dll
20.11.2005 15:09 234.787 szhcinst.dll
20.11.2005 15:09 235.194 jt0407dqe.dll
20.11.2005 15:07 234.787 mbutb.dll
20.11.2005 15:07 236.241 l4n4le5q1h.dll
20.11.2005 00:31 <DIR> dllcache
20.11.2005 00:02 234.787 event97.dll
20.11.2005 00:01 234.787 enpml1711.dll
19.11.2005 19:02 234.787 mdv1_0.dll
19.11.2005 18:29 234.787 mn43dmod.dll
19.11.2005 16:24 236.271 j2j6lc1s1f.dll
19.11.2005 14:36 <DIR> Microsoft
11 Datei(en) 2.587.410 Bytes
2 Verzeichnis(se), 5.265.248.256 Bytes frei

Hallo,
besorge die Killbox und lösche(on reboot) die Datei C:\\WINDOWS\\system32\\guard.tmp
Dann führst du L2mfix mit Option 2 und und danach mit Option 4 aus.
Dann postest du das Logfile das nach dem ausführen von Option 2 erschienen ist und ein neues HijackThis Log.


Grüße Wildone

nach option 2 gabs keine neue log.

aktuelle hijack this log ist :

Logfile of HijackThis v1.99.1
Scan saved at 10:32:59, on 21.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
d:\Programme\AVPersonal\AVGUARD.EXE
d:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\explorer.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Winamp\winampa.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\VVSN\VVSN.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\Lani\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=explorer.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [VVSN] C:\Programme\VVSN\VVSN.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/webmasterexe/drsmartload114a.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132358055776
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2DD65DBE-A8EB-46C7-B334-97CFD3DA24D0}: NameServer = 217.237.149.225 194.25.2.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0433480-4439-46ED-B880-71DD78CE0EC4}: NameServer = 141.48.18.1
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\n62u0gf9e62.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - d:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - d:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe

Hallo,
das scheint nicht funktioniert zu haben, mach mal folgendes. Danach läßt du auch noch ewido drüberlaufen und postest danach ein neues HijackThis Log.


Grüße Wildone

beide programme haben wiedermal dies das und jenes gefunden.
Unter anderem habe ich mitbekommen das mein system durh firewall alle 5 secs ca ein verbindungsversuch zu w**.a-d-w-a-r-e.com blockt, was glaube ursprung allen übels war ( die sich selbstständig öffnenden internetseiten hatten oft den inhalt), wobei ich nie auf der seite war und auch nicht einfach sinnlos was installiert hab. lediglich nach Neuinstallation servicepack und einige treiber.

hier die hijack nach beiden progs :

Logfile of HijackThis v1.99.1
Scan saved at 20:25:27, on 21.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Winamp\winampa.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
d:\Programme\AVPersonal\AVGUARD.EXE
d:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Programme\WinTV\WinTV2K.EXE
C:\Dokumente und Einstellungen\Lani\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=explorer.exe
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132358055776
O17 - HKLM\System\CCS\Services\Tcpip\..\{2DD65DBE-A8EB-46C7-B334-97CFD3DA24D0}: NameServer = 217.237.149.225 194.25.2.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0433480-4439-46ED-B880-71DD78CE0EC4}: NameServer = 141.48.18.1
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - d:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - d:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe

ein liebes danke btw fürs annehmen meines problems