| |
| |||||||
Log-Analyse und Auswertung: ucookw.exe...Tronjaner???Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
20.11.2007, 07:34
| #1 |
| |  ucookw.exe...Tronjaner??? Hallo ich hatte das geliche Problem wie hier: Habe im abgesicherten Modus mein pc gesaübert mit counterspy v2. Soweit so gut... ich habe aber jetzt wenn ich den tm aufmache einen Prozess namens "ucookw.exe" der mir sorgen macht. Könnt ihr mir sagen was das ist oder ob ich noch andere Viren oder Trojaner auf meinem PC hab? Mein H. Logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:25:37, on 20.11.2007 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16546) Boot mode: Normal Running processes: C:\Windows\SOUNDMAN.EXE C:\Program Files (x86)\Steam\Steam.exe F:\mousometer.exe C:\Program Files (x86)\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_SL.exe C:\Program Files (x86)\PowerISO\PWRISOVM.EXE C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files (x86)\Trend Micro\Internet Security 2007\pccguide.exe C:\Program Files (x86)\WinPCDoctor\ucookw.exe C:\Program Files (x86)\Sunbelt Software\CounterSpy\SBCSTray.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local;*.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files (x86)\Video Add-on\isfmdl.dll (file missing) O3 - Toolbar: IE Custom Tools - {70CC76D5-A4EE-4F25-9931-B109A63E298E} - C:\Program Files (x86)\Video Add-on\ictmdl.dll (file missing) O4 - HKLM\..\Run: [MMTray] "C:\Program Files (x86)\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PWRISOVM.EXE] "C:\Program Files (x86)\PowerISO\PWRISOVM.EXE" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files (x86)\Trend Micro\Internet Security 2007\pccguide.exe" O4 - HKLM\..\Run: [ucookw] "C:\PROGRA~2\WINPCD~1\ucookw.exe" -start O4 - HKLM\..\Run: [SBCSTray] C:\Program Files (x86)\Sunbelt Software\CounterSpy\SBCSTray.exe O4 - HKLM\..\Run: [SBRegRebootCleaner] "C:\Program Files (x86)\Sunbelt Software\CounterSpy\SBRC.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [LDM] C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files (x86)\Video Add-on\isfmntr.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: Verknüpfung mit mousometer.lnk = F:\mousometer.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.topsoftwarefeed.com/redirect.php (file missing) O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6\ICQ.exe O13 - Gopher Prefix: O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9EB7B8BD-6C39-4626-85F7-6258C5BFF045}: NameServer = 4.2.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{9EB7B8BD-6C39-4626-85F7-6258C5BFF045}: NameServer = 4.2.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{9EB7B8BD-6C39-4626-85F7-6258C5BFF045}: NameServer = 4.2.2.1 O18 - Protocol: bw+0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: offline-8876480 - {59C22736-4030-45B7-BB8C-294469066BF8} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~2\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Spyware-Schutz (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~2\TRENDM~1\INTERN~1\PcScnSrv.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files (x86)\Sunbelt Software\CounterSpy\SBCSSvc.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~2\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~2\TRENDM~1\INTERN~1\tmproxy.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 21838 bytes |
|
20.11.2007, 16:56
| #2 | |||
 |  ucookw.exe...Tronjaner??? Hallo und
__________________ Herzlich Willkommen im Trojaner-Board deine Vermutung liegt richtig. Diese Datei ist zumindestenz ein unerwünschter Prozess, wenn nicht sogar ein Trojaner. Er kommt mit dem WinPCDoctor. Mach bitte folgendes: 1) Deinstalliere den WinPCDoctor, wenn möglich. (Beende zuvor den Prozess im Taskmanager: Zitat:
2) Lösche den komplette Ordner: Zitat:
- Führe deine Hijackthis.exe - Datei aus (bestätige die eventuelle Warnung mit "ok") - Wähle die Option "Do only a System Scan" - Setze bei folgenden Einträgen links im Kästchen einen Haken Zitat:
4) neuer hijackthislog + escan * MWAV (eScan) - Free Antivirus 1. Lies dir folgende Anleitung genau durch und arbeite sie ab -> Anleitung eScan (Bei Updateproblemen -> Updateprobleme beheben (Sollte der Hinweis erscheinen, dass du nur mit der Vollversion die Funde löschen kannst, breche den Scan NICHT ab) 2. Poste im Anschluss das Ergebnis mit Hilfe der *find.bat'. - rechte Maustaste auf den LINK 'find.bat' , dann "Ziel Speichern unter" -> Desktop) - führe die find.bat aus - das erstellte Log kopierst du ab und postest in deinen nächsten Beitrag 3. Entferne bitte nicht selber von escan alarmierte Funde. Es sind erfahrungsgemäß viele Fehlalarme dabei mfg Cleriker |
|
09.01.2008, 19:43
| #3 |
| | ucookw.exe...Tronjaner??? Hallo,
__________________ich lasse das thema noch einmal aufleben...sry das ich mich so lange nicht gemeldet hab... und zwar: - den winpcdoctor hatte ich kurz nach meinem post hier im forum gelöscht (deinstalliert) - nun habe ich vor kurzem einen scan mit einem languard gemacht der mir eine sicherheitslücker gemeldet hat, einen offenen port der vermutlich von einem trojaner genutzt wird - ich habe darauf escan nach der anleitung installiert...im abgesicherten modus--- da ich aber vista habe funktioniert die netzwerkunterstützung nicht und ich kann das programm nicht updaten!!!  außerdem hab ich noch eine frage zu dem logfile das man runterladen soll: was soll ich damit machen??? irgendwie importieren, außführen oder was?!? Vielen Dank im Voraus! Greetz Timk |
|
| Themen zu ucookw.exe...Tronjaner??? |
| abgesicherten modus, add-on, adobe, antispyware, bho, central, desktop, excel, explorer, firefox, firewall, hijack, hijackthis, internet, internet explorer, internet security, logfile, mozilla, mozilla firefox, object, pdf, poweriso, problem, prozess, rundll, shockwave, software, symantec, trend micro, viren, vista, windows, windows sidebar, wmp |
Linear-Darstellung
