|
Log-Analyse und Auswertung: Drop Agen dgo 8 gefunden !Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.12.2007, 10:51 | #1 |
| Drop Agen dgo 8 gefunden ! Hallo,kann sich mal jemand mein Logfile anschauen...ich bekomme ständig Meldungen von AntiVir bezüglich "Drop Agent dg0 8. Logfile of HijackThis v1.99.1 Scan saved at 10:20:19, on 30.12.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS.0\System32\smss.exe C:\WINDOWS.0\system32\winlogon.exe C:\WINDOWS.0\system32\services.exe C:\WINDOWS.0\system32\lsass.exe C:\WINDOWS.0\system32\svchost.exe C:\WINDOWS.0\System32\svchost.exe C:\WINDOWS.0\system32\ZoneLabs\vsmon.exe C:\WINDOWS.0\system32\spoolsv.exe D:\Prg4win\Avira\AntiVir PersonalEdition Classic\avguard.exe D:\Prg4win\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\nvidia\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS.0\system32\nvsvc32.exe C:\WINDOWS.0\system32\PnkBstrA.exe C:\WINDOWS.0\system32\PnkBstrB.exe C:\Programme\Cyberlink\Shared files\RichVideo.exe d:\prg4win\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS.0\system32\svchost.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\Programme\Logitech\iTouch\iTouch.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient .exe C:\WINDOWS.0\vsnpstd3.exe C:\Programme\Logitech\iTouch\iTouch .exe D:\Prg4win\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Microsoft IntelliPoint\ipoint.exe C:\Programme\Microsoft IntelliPoint\ipoint .exe C:\WINDOWS.0\system32\wbem\wmiapsrv.exe C:\WINDOWS.0\vsnpstd3 .exe C:\WINDOWS.0\system32\RUNDLL32.EXE D:\Prg4win\Weather Alarm Clock\WeatherAlarmClock.exe C:\Programme\Microsoft IntelliPoint\dpupdchk.exe D:\prg4win\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS.0\system32\ctfmon.exe C:\WINDOWS.0\system32\ctfmon .exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Alice\Signup\AliceCnn.exe C:\Programme\T-Online\DSL-Manager\DslMgr.exe C:\Programme\T-Online\DSL-Manager\DslMgrSvc.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS.0\system32\wuauclt.exe C:\WINDOWS.0\explorer.exe C:\Dokumente und Einstellungen\***********\Desktop\abc.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://alice.aol.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://alice.aol.de R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {04EC7243-1F11-4F90-B761-049A49CB9BAC} - C:\WINDOWS.0\system32\jkhfd.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\Prg4win\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {B0EEDC94-E177-43D2-B600-84E7AC69969B} - C:\WINDOWS.0\system32\pmnonnm.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS.0\tsnpstd3.exe O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS.0\vsnpstd3.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [avgnt] "D:\Prg4win\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [HostManager] C:\Programme\Gemeinsame Dateien\AOL\1181860889\ee\AOLSoftware.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Programme\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.0\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\RunOnce: [KB926239] rundll32.exe apphelp.dll,ShimFlushCache O4 - HKCU\..\Run: [WeatherAlarmClock] D:\Prg4win\Weather Alarm Clock\WeatherAlarmClock.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\prg4win\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [zRain] D:\Prg4win\Weather Alarm Clock\zRain.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe O4 - HKCU\..\Run: [NVIDIA nTune] "C:\nvidia\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - Startup: DSL-Manager.lnk = C:\Programme\T-Online\DSL-Manager\DslMgr.exe O8 - Extra context menu item: &Clean Traces - d:\prg4win\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - D:\Prg4win\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - D:\Prg4win\DAP\dapextie2.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS.0\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Prg4win\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Prg4win\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188405810203 O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1188405794984 O16 - DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} (IPSUploader4 Control) - http://photoservice.fujicolor.de/ips-opdata/layout/fuji01/activex/IPSUploader4.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FF97159B-558B-43B0-8354-F8EF0A483405}: NameServer = 213.191.74.11 213.191.92.82 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\WINDOWS.0\Downloaded Program Files\mimectl.dll O20 - Winlogon Notify: pmnonnm - C:\WINDOWS.0\SYSTEM32\pmnonnm.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.0\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS.0\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - D:\Prg4win\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - D:\Prg4win\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Prg4win\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: Hotspot Manager (HotSpotFSvc) - Unknown owner - C:\Programme\Gemeinsame Dateien\T-COM\HotspotMgr\HotSpotFSvc.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\nvidia\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS.0\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS.0\system32\PnkBstrB.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\Cyberlink\Shared files\RichVideo.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - d:\prg4win\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: DSL-Manager (TDslMgrService) - T-Systems Enterprise Services GmbH - C:\Programme\T-Online\DSL-Manager\DslMgrSvc.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS.0\System32\TuneUpDefragService.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS.0\system32\ZoneLabs\vsmon.exe |
30.12.2007, 11:19 | #2 |
| Drop Agen dgo 8 gefunden ! mir ist noch aufgefallen das ctfmon.exe in meinem Taskmanager 2 mal läuft.
__________________Ist das normal? |
Themen zu Drop Agen dgo 8 gefunden ! |
antivir, avira, bho, cyberlink, desktop, dll, download, einstellungen, excel, explorer, firefox, hijack, hijackthis, hotspot, internet, internet explorer, logfile, magix, monitor, mozilla, mozilla firefox, nvidia, pop-up-blocker, programme, rundll, software, system, t-online, traces, tuneup.defrag, urlsearchhook, windows, windows xp, yahoo |