| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer Pop-Ups+deren FolgenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.08.2007, 18:33
| #1 |
| |  Internet Explorer Pop-Ups+deren Folgen Ich habe bereits mind. eine Stunde im Forum nach einen passenden Thema gesucht, habe aber nur ähnliche gefunden ein keins, dass mir recht weiterhelfen konnte. Seit einiger Zeit öffnet sich dauernd mein IE6 mit Werbepop-ups (kennt man ja). Die Werbung ist für Antiviren/spam Programme die man kaufen soll. ca. alle 2 Minuten kommt ein neues Pop-up (auch wenn ich nicht online bin bzw. in einem LAN!). In der Taskleistete blinkte auch dauernd ein "!" auf, dass ähnlich aussah wie das Windows Update "!". Ich habe Norton (-,-) über den Windows ordner laufen lassen; nichts gefunden. VundoFix hat dann eine datei identifiziert (xmaepbhv.dll) und sie löschen können (glaube ich). Nachdem ich das gemacht habe kamen (bis jetzt) keine Pop-ups mehr und das "!" ist auch weg. Dafür gab es plötzlich auf meinem Desktop 2 Verknüpfungen (Live Safety Center und Online Security Guide) deren ZielORT der IE ist und Ziel(TYP) eine Internet adresse. Ganz wird sie nicht angezeigt nur [i]"h**p://htepo.com/cehpmoin/?cmp_hmrlid=1_1..." (ka ob das wichtig ist). Die Verknüpfungen kamen ganz von selbst und ich würde gerne wissen ob mein Rechner sauber ist. So ganz hat das ja nicht den Anschein :-/ Langer Text, kurzer Sinn. Wäre nett wenn ihr mir irgendwie helfen könntet. HiJackThis: Logfile of HijackThis v1.99.1 Scan saved at 19:10:56, on 16.08.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE G:\Programme\Norton AntiVirus\navapsvc.exe G:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\Programme\Cyberlink\Shared Files\RichVideo.exe G:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE G:\Programme\SBAudigy LS\Surround Mixer\CTSysVol.exe G:\Programme\ICQLite\ICQLite.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\WINDOWS\Logi_MwX.Exe C:\Programme\Java\jre1.5.0_11\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe G:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe G:\Programme\Logitech\SetPoint\SetPoint.exe G:\Programme\Opera\Opera.exe C:\Programme\Java\jre1.5.0_11\bin\jucheck.exe G:\Programme\WinRAR\WinRAR.exe G:\Programme\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://mail.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - G:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - G:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file) O4 - HKLM\..\Run: [CTSysVol] G:\Programme\SBAudigy LS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [zBrowser Launcher] G:\Programme\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [ICQ Lite] "G:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] G:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] G:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = G:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = G:\Programme\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://G:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wecker-Alarm - {7B499570-29C5-4a80-9F57-94A420D140CE} - g:\Programme\Wecker6\WfWIEButton.dll O9 - Extra 'Tools' menuitem: Nach Wecker für Windows exportieren - {7B499570-29C5-4a80-9F57-94A420D140CE} - g:\Programme\Wecker6\WfWIEButton.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - G:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - G:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) – h**p://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176838979703 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) – h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bw+0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - G:\Programme\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - G:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\Cyberlink\Shared Files\RichVideo.exe O23 - Service: SAVScan - Symantec Corporation - G:\Programme\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - G:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe |
|
16.08.2007, 19:44
| #2 | ||
| > MalwareDB   | Internet Explorer Pop-Ups+deren Folgen Führe Vundofix aus.
__________________Zitat:
Zitat:
Bata |
|
16.08.2007, 22:01
| #3 |
| | Internet Explorer Pop-Ups+deren Folgen Also der VundoFix hat nichts mehr gefunden. Und wo das Logfile von VundoFix ist weiß ich nicht.
__________________Hier der Log von ComboFix: ComboFix 07-08-14.4 - "NAME" 2007-08-16 22:48:22.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.727 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\pmkhe.dll ((((((((((((((((((((((((( Files Created from 2007-07-16 to 2007-08-16 ))))))))))))))))))))))))))))))) 2007-08-16 22:47 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-16 20:30 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-08-16 20:30 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-08-16 20:30 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-08-16 20:30 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll 2007-08-16 20:30 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-08-16 20:30 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-08-16 20:30 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll 2007-08-16 20:30 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-08-16 20:30 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-08-16 20:30 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-08-16 20:30 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll 2007-08-16 20:30 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-08-16 20:30 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-08-16 20:30 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-08-16 20:30 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-08-16 20:30 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-08-16 20:30 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-08-16 20:30 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-08-16 20:30 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2007-08-16 20:30 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll 2007-08-16 20:30 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-08-16 20:29 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-08-16 18:57 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-08-16 18:54 <DIR> d-------- C:\VundoFix Backups 2007-08-16 16:17 131,680 --------- C:\WINDOWS\system32\xmaepbhv.dll 2007-08-16 16:12 43,542 --a------ C:\WINDOWS\system32\iifdaxy.dll 2007-08-14 19:53 <DIR> d-------- C:\Programme\MSXML 6.0 2007-08-14 00:29 <DIR> d-------- C:\DOKUME~1\NAME\ANWEND~1\Logitech 2007-08-14 00:28 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe 2007-08-14 00:26 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2007-08-14 00:26 68,992 --a------ C:\WINDOWS\system32\drivers\LMouKE.Sys 2007-08-14 00:26 52,992 --a------ C:\WINDOWS\system32\drivers\L8042mou.Sys 2007-08-14 00:26 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys 2007-08-14 00:26 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll 2007-07-27 11:09 <DIR> d-------- C:\DOKUME~1\NAME\ANWEND~1\InstallShield Installation Information 2007-07-26 17:22 <DIR> d-------- C:\DOKUME~1\NAME\ANWEND~1\Apple Computer 2007-07-26 17:21 <DIR> d-------- C:\Programme\iPod 2007-07-26 17:19 <DIR> d-------- C:\Programme\QuickTime 2007-07-26 17:19 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple Computer 2007-07-26 17:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2007-07-26 17:18 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Apple 2007-07-26 17:18 <DIR> d-------- C:\Programme\Apple Software Update 2007-07-26 17:18 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Apple 2007-07-22 15:13 <DIR> d-------- C:\DOKUME~1\NAME\ANWEND~1\CyberLink 2007-07-22 15:13 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\CyberLink 2007-07-22 14:53 <DIR> d-------- C:\Programme\Cyberlink 2007-07-16 09:37 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys 2007-07-16 09:37 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys 2007-07-16 09:37 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-07-16 09:37 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-07-16 08:01 <DIR> d-------- C:\DOKUME~1\NAME\ANWEND~1\COWON 2007-07-16 07:59 <DIR> d-------- C:\Programme\Gemeinsame Dateien\COWON (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-15 15:42 --------- d--h----- C:\Programme\InstallShield Installation Information 2007-08-14 00:26 --------- d-------- C:\Programme\Gemeinsame Dateien\Logitech 2007-07-25 20:14 --------- d-------- C:\DOKUME~1\NAME\ANWEND~1\Hamachi 2007-07-24 19:05 25544 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2007-07-19 08:56 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-07-16 07:58 --------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield 2007-07-13 01:30 765952 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2007-07-13 00:33 --------- d-------- C:\Programme\AOL 9.0 2007-07-10 18:02 --------- d-------- C:\Programme\MSXML 4.0 2007-07-07 18:18 --------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard 2007-07-07 08:21 --------- d-------- C:\Programme\Creative 2007-07-03 07:48 --------- d-------- C:\Programme\Gemeinsame Dateien\aol 2007-07-01 01:37 --------- d-------- C:\Programme\Gemeinsame Dateien\aolshare 2007-07-01 01:37 --------- d-------- C:\DOKUME~1\NAME\ANWEND~1\AOL 2007-07-01 01:36 --------- d-------- C:\Programme\Viewpoint 2007-07-01 01:36 --------- d-------- C:\Programme\Learn2.com 2007-07-01 01:36 --------- d-------- C:\Programme\Gemeinsame Dateien\Nullsoft 2007-07-01 01:36 --------- d-------- C:\DOKUME~1\NAME\ANWEND~1\You've Got Pictures Screensaver 2007-07-01 01:35 8552 --a------ C:\WINDOWS\system32\drivers\asctrm.sys 2007-07-01 01:35 --------- d-------- C:\Programme\Real 2007-07-01 01:35 --------- d-------- C:\Programme\Gemeinsame Dateien\Real 2007-06-27 16:05 823808 --a--c--- C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-27 16:05 671232 --a--c--- C:\WINDOWS\system32\dllcache\mstime.dll 2007-06-27 16:05 52224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-06-27 16:05 477696 --a--c--- C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-06-27 16:05 459264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-06-27 16:05 27648 --a--c--- C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-06-27 16:05 232960 -----c--- C:\WINDOWS\system32\dllcache\webcheck.dll 2007-06-27 16:05 193024 --a--c--- C:\WINDOWS\system32\dllcache\msrating.dll 2007-06-27 16:05 1152000 --a--c--- C:\WINDOWS\system32\dllcache\urlmon.dll 2007-06-27 16:05 105984 -----c--- C:\WINDOWS\system32\dllcache\url.dll 2007-06-27 16:05 102400 -----c--- C:\WINDOWS\system32\dllcache\occache.dll 2007-06-27 16:04 6058496 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2007-06-27 16:04 44544 -----c--- C:\WINDOWS\system32\dllcache\iernonce.dll 2007-06-27 16:04 384512 -----c--- C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-06-27 16:04 383488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-06-27 16:04 267776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2007-06-27 16:04 230400 -----c--- C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-06-27 16:04 153088 -----c--- C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-06-27 16:04 132608 --a--c--- C:\WINDOWS\system32\dllcache\extmgr.dll 2007-06-27 16:04 124928 -----c--- C:\WINDOWS\system32\dllcache\advpack.dll 2007-06-27 10:27 63488 -----c--- C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-06-27 10:27 13824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-06-27 10:26 625152 -----c--- C:\WINDOWS\system32\dllcache\iexplore.exe 2007-06-27 09:00 161792 --a--c--- C:\WINDOWS\system32\dllcache\ieakui.dll 2007-06-26 19:32 --------- d-------- C:\Programme\Vstplugins 2007-06-26 19:31 --------- d-------- C:\DOKUME~1\NAME\ANWEND~1\Sony 2007-06-26 19:31 --------- d-------- C:\DOKUME~1\NAME\ANWEND~1\Publish Providers 2007-06-26 19:08 --------- d-------- C:\Programme\Microsoft SQL Server 2007-06-26 08:08 1104896 --a--c--- C:\WINDOWS\system32\dllcache\msxml3.dll 2007-06-26 08:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-19 15:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-19 15:31 282112 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2007-06-17 15:14 --------- d-------- C:\Programme\Gemeinsame Dateien\AVSMedia 2007-06-17 15:14 --------- d-------- C:\Programme\AVSMedia 2007-06-13 15:21 1036288 --a------ C:\WINDOWS\explorer.exe 2007-06-13 15:21 1036288 -----c--- C:\WINDOWS\system32\dllcache\explorer.exe 2007-05-17 13:28 549376 --a------ C:\WINDOWS\system32\oleaut32.dll 2007-05-17 13:28 549376 -----c--- C:\WINDOWS\system32\dllcache\oleaut32.dll 2007-05-16 17:12 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 17:12 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 17:11 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 17:11 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 17:11 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 17:11 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="G:\Programme\SBAudigy LS\Surround Mixer\CTSysVol.exe" [2003-05-02 09:53] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00] "zBrowser Launcher"="G:\Programme\Logitech\iTouch\iTouch.exe" [2002-11-23 02:15] "ICQ Lite"="G:\Programme\ICQLite\ICQLite.exe" [2006-07-11 12:15] "ccApp"="C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" [2003-08-19 20:21] "Advanced Tools Check"="G:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" [2003-08-22 21:17] "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 09:50 C:\WINDOWS\LOGI_MWX.EXE] "SunJavaUpdateSched"="C:\Programme\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 03:23] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Steam"="" [] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:57] "LDM"="G:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-08-14 00:28] C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\ Logitech Desktop Messenger.lnk - G:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-08-14 00:28:30] Logitech SetPoint.lnk - G:\Programme\Logitech\SetPoint\SetPoint.exe [2007-08-14 00:26:43] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk backup=C:\WINDOWS\pss\Adobe Reader - Schnellstart.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^AOL 9.0 Tray-Symbol.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\AOL 9.0 Tray-Symbol.lnk backup=C:\WINDOWS\pss\AOL 9.0 Tray-Symbol.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Logitech Desktop Messenger.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech Desktop Messenger.lnk backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "G:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] C:\Programme\Electronic Arts\EA Downloader\Core.exe -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "G:\Programme\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] g:\Programme\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM] G:\Programme\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Programme\Messenger\MSMSGS.EXE" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] g:\Programme\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "G:\Programme\Steam\Steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] G:\Programme\Winamp\winampa.exe R3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINDOWS\system32\DRIVERS\L8042mou.Sys R3 P17;Creative SB Audigy LS;C:\WINDOWS\system32\drivers\P17.sys S3 CEDRIVER50;CEDRIVER50;\??\g:\Programme\Cheat Engine\DBK32.sys S3 itchfltr;iTouch Keyboard Filter;C:\WINDOWS\system32\DRIVERS\itchfltr.sys S3 NPDriver;Norton Unerase Protection Driver;\??\C:\WINDOWS\system32\Drivers\NPDRIVER.SYS S3 ShadowDefence;Shadow Defence;\??\C:\DOKUME~1\NAME\LOKALE~1\Temp\SDef.sys Contents of the 'Scheduled Tasks' folder 2007-04-28 08:48:21 C:\WINDOWS\Tasks\Part 10.job 2007-08-16 20:52:40 C:\WINDOWS\Tasks\Symantec NetDetect.job - C:\Programme\Symantec\LiveUpdate\NDETECT.EXE ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-16 22:51:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-16 22:54:20 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-16 22:54 --- E O F --- |
|
17.08.2007, 00:13
| #4 | |
| > MalwareDB | Internet Explorer Pop-Ups+deren Folgen Das Vundo Log liegt unter c:\vundoFix.txt Lade Dir Avenger: - Input script manually (anhaken) - die "Lupe" rechts anklicken - View/edit script (wird sich öffnen) - kopiere rein: Zitat:
- Klicke die grüne Ampel - das Script wird nun ausgeführt, dann wird der PC nach Bestätigung (yes) neustarten Poste das Avenger Log, zusammen mit einem neuen HJT Log. Bata |
|
17.08.2007, 07:43
| #5 |
| | Internet Explorer Pop-Ups+deren Folgen So hier nochmal der VundoFix log (die xmaepbhv.dll scheint er doch nicht gelöscht zu haben): VundoFix V6.5.7 Checking Java version... Sun Java not detected Scan started at 18:54:32 16.08.2007 Listing files found while scanning.... C:\WINDOWS\system32\xmaepbhv.dll Beginning removal... Attempting to delete C:\WINDOWS\system32\xmaepbhv.dll C:\WINDOWS\system32\xmaepbhv.dll Could not be deleted. Performing Repairs to the registry. Done! Beginning removal... Attempting to delete C:\WINDOWS\system32\xmaepbhv.dll C:\WINDOWS\system32\xmaepbhv.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V6.5.7 Checking Java version... Sun Java not detected Scan started at 22:44:44 16.08.2007 Listing files found while scanning.... No infected files were found. Avenger log: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\abetcqjp ******************* Script file located at: \??\C:\ulrtywrf.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Folder C:\VundoFix Backups deleted successfully. File C:\WINDOWS\system32\xmaepbhv.dll deleted successfully. File C:\WINDOWS\system32\iifdaxy.dll deleted successfully. Completed script processing. ******************* Finished! Terminate. HJT: Logfile of HijackThis v1.99.1 Scan saved at 08:40:13, on 17.08.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\System32\CTSvcCDA.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE G:\Programme\Norton AntiVirus\navapsvc.exe G:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\Programme\Cyberlink\Shared Files\RichVideo.exe G:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE G:\Programme\SBAudigy LS\Surround Mixer\CTSysVol.exe G:\Programme\ICQLite\ICQLite.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\WINDOWS\Logi_MwX.Exe C:\Programme\Java\jre1.5.0_11\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe G:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe G:\Programme\Logitech\SetPoint\SetPoint.exe C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE C:\WINDOWS\system32\wuauclt.exe G:\Programme\Opera\Opera.exe G:\Programme\ANTIVIRUSPROGRAMME\HiJackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://mail.google.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - G:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - G:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [CTSysVol] G:\Programme\SBAudigy LS\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [zBrowser Launcher] G:\Programme\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [ICQ Lite] "G:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] G:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_11\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] G:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\RunOnce: [ICQ Lite] G:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: Logitech Desktop Messenger.lnk = G:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Logitech SetPoint.lnk = G:\Programme\Logitech\SetPoint\SetPoint.exe O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://G:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Wecker-Alarm - {7B499570-29C5-4a80-9F57-94A420D140CE} - g:\Programme\Wecker6\WfWIEButton.dll O9 - Extra 'Tools' menuitem: Nach Wecker für Windows exportieren - {7B499570-29C5-4a80-9F57-94A420D140CE} - g:\Programme\Wecker6\WfWIEButton.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - G:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {0e921e80-267a-42aa-aee4-60b9a1222a44} - G:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {0e921e80-267a-42aa-aee4-60b9a1222a44} - G:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1176838979703 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bw+0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {11219217-9735-4D80-A331-95DCC7E6CC50} - G:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - G:\Programme\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - G:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\Cyberlink\Shared Files\RichVideo.exe O23 - Service: SAVScan - Symantec Corporation - G:\Programme\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - G:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe Danke für deine Hilfe =)
__________________ Mit freundlichen Grüßen, RaT Geändert von RaT (17.08.2007 um 07:45 Uhr) Grund: http --> h**p Ausbesserung vergessen |
|
| Themen zu Internet Explorer Pop-Ups+deren Folgen |
| adobe, antivirus, bho, cyberlink, desktop, drivers, excel, explorer, internet, internet explorer, lan, löschen, nicht angezeigt, object, opera, ordner, pdf, pop-ups, programme, security, shockwave, software, symantec, system, taskleiste, von selbst, werbung, windows, windows xp, öffnet |
Linear-Darstellung
