habe immer wieder nicht gravierende, aber nervende Problem mit meinem PC (WinME).
Habe schon den Tip bekommen, Autostart und laufende Prozesse zu überprüfen. Diese zu finden, ist kein Problem, allerdings die Bewertung einiger doch. Wenn ich die Ergebnisse hier mal präsentiere, würde sich da jemand finden, der diese mal auf verdächtige Einträge überprüft? Ich selbst kann nur mit etwa der Hälfte etwas anfangen.Ich weiss aber auch, dass es kaum jemanden gibt, der alle kennt.

Vielleicht wäre es gut wenn du schreiben könntest, was denn genau passiert und/oder was nicht?

Björn

Ja dann mach doch mal. Wir werden schon alles herausfinden [img]smile.gif[/img]

Ich stelle es erst mal zur Diskussion:

Prüfung mit ANTS:
a) Autostart unter Registry:
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Tweak UI 1.33 deutsch = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
RegisterDropHandler = C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE
NAV Agent = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
Reminder = C:\Programme\Microsoft Money\System\reminder.exe

b) ......... unter Autoexec.bat:
SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\PROGRA~1\ETIKET~1;C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

c) ........unter Winstart.bat:
@C:\WINDOWS\tmpcpyis.bat

d)..........unter WIN.INI:
ptsnoop.exe

e)..........unter SYSTEM.INI
Explorer.exe


f) laufene Prozesse mit ANTS:
Prozess ID Dateiname FF8F1DAB C:\WINDOWS\SYSTEM\KERNEL32.DLL FFFF5B13 C:\WINDOWS\SYSTEM\MSGSRV32.EXE FFFFFB53 C:\WINDOWS\SYSTEM\mmtask.tsk FFFFF097 C:\WINDOWS\SYSTEM\MPREXE.EXE FFFFC003 C:\WINDOWS\SYSTEM\MSTASK.EXE FFFE4B13 C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE FFFE881F C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE FFFE052B C:\WINDOWS\EXPLORER.EXE FFFD6703 C:\WINDOWS\SYSTEM\STIMON.EXE FFFD9BBB C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE FFFDD7FF C:\WINDOWS\SYSTEM\SPOOL32.EXE FFFCB5AF C:\WINDOWS\PTSNOOP.EXE FFFCA357 C:\WINDOWS\TASKMON.EXE FFFB3587 C:\WINDOWS\SYSTEM\SYSTRAY.EXE FFFC7E37 C:\PROGRAMME\NORTON ANTIVIRUS\NAVAPW32.EXE FFFB7B83 C:\WINDOWS\SYSTEM\WMIEXE.EXE FFFC708B C:\PROGRAMME\MICROSOFT MONEY\SYSTEM\REMINDER.EXE FFFBB2AB C:\PROGRAMME\ZONE LABS\ZONEALARM\ZAPRO.EXE FFFBFAA7 C:\PROGRAMME\GEMEINSAME DATEIEN\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE FFFACAA7 C:\PROGRAMME\ONLINECOUNTER 2004\ONLINECOUNTER.EXE FFF94D4B C:\PROGRAMME\ZUBEHöR\WORDPAD.EXE FFF82A03 C:\PROGRAMME\ANTS\ANTS.EXE FFF805EF C:\WINDOWS\NOTEPAD.EXE


g)Autostartregister in msconfighabe hier noch nie etwas geändert)

Reminder
Scanregistry
TaskMonitor
PCHealth
System Tray
LoadPowerProfile
Treak UI 1.33
RegisterDropHändler
NAV Agent
*StateMgr
TrueVector
minilog
Scriptblocking
SSDPSRV (hat kein Häckchen)
ZONEALARM
Verknüpfung mit Kalendererinnerungen
Microsoft Office Autostart
Startet SWR3 OnlineCounter..... und überwacht im Hintergrund
load=

Oder Such mal hier -> Start UP Liste .
Mann kann auch die komplette Liste (tabelarisch) herunterladen -> http://www.pacs-portal.co.uk/startup_index.htm

MfG abbi

Wenn du uns den Report von Trojancheck schickst, wird das mit den Autostarteinträgen schon machbar sein.

ciao

Kein wunder, was mit deinem PC los war. Du hast nämlich ein RAT (RemoteAdministarationTool) drauf.

</font><blockquote>Zitat:</font><hr />
d)..........unter WIN.INI:
ptsnoop.exe
</font>[/QUOTE]Schau mal hier.
Ich würde dir raten mal von der oben angegebenen URL Trojancheck zu installieren. Der Report dort ist um einiges umfassender, und zum anderen kannst du dort auch gleich die Autostarteinträge bearbeiten bzw. löschen.

ciao

Achtung: "ptsnoop.exe" ist nicht zwangsläufig ein RAT. Bei meinem Notebook ist das für das Modem (Software-Modem?) zuständig!

Vielleicht mal in die Eigenschaften der ptsnoop.exe schauen, bzw. die Datei genauer überprüfen!

Gruß [img]graemlins/daumenhoch.gif[/img]
Yopie

edit: Jetzt macht der zweite Satz mehr Sinn!

[ 11. Oktober 2003, 16:07: Beitrag editiert von: Yopie ]

Ist leider in Englisch, was ich meist nicht sinngerecht übersetzen kann.
Mache jetzt die Analyse mit Trojanscheck.

ptsnoop.exe befindet unter C:\Windows und wurde 4 Tage vor den PC-Kauf erstellt (Größe 9.898 Bytes). Mehr habe ich dazu nicht herausgefunden.
Im PC ist ein internes Modem indstalliert. In der Registry habe ich keine Einträge zu ptsnoop gefunden.

Hier nun das Ergebnis von TC-6:

Trojancheck 6 Report
Created: 11.10.2003 16:07:50

Navigation
Registry - Standardeinträge
Registry - Shell Spawning
Registry - Active Setup
Registry - Virtuelle Gerätetreiber (VxD)
Registry - ICQ Net
Autostart - Standardeinträge
INI Dateien
Batch und Text Dateien
EXPLORER.EXE in C:\

--------------------------------------------------------------------------------

Registry - Standardeinträge
Hauptschlüssel
(Rootkey) Schlüssel Wert Inhalt
HKEY_CURRENT_USER Software\Microsoft\Windows\CurrentVersion\Run Reminder C:\Programme\Microsoft Money\System\reminder.exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run ScanRegistry C:\WINDOWS\scanregw.exe /autorun
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run TaskMonitor C:\WINDOWS\taskmon.exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run PCHealth C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run SystemTray SysTray.Exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run LoadPowerProfile Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run Tweak UI 1.33 deutsch RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run RegisterDropHandler C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Run NAV Agent C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices LoadPowerProfile Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices SchedulingAgent mstask.exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices RegisterDropHandler C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices *StateMgr C:\WINDOWS\System\Restore\StateMgr.exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices TrueVector C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices minilog C:\WINDOWS\SYSTEM\ZoneLabs\MINILOG.EXE -service
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices ScriptBlocking "C:\Programme\Gemeinsame Dateien\Symantec Shared\Script Blocking\SBServ.exe" -reg


Top

Registry - Shell Spawning
Hauptschlüssel
(Rootkey) Schlüssel Wert Inhalt
HKEY_CLASSES_ROOT \exefile\shell\open\command "%1" %*
HKEY_CLASSES_ROOT \comfile\shell\open\command "%1" %*
HKEY_CLASSES_ROOT \batfile\shell\open\command "%1" %*
HKEY_CLASSES_ROOT \htafile\Shell\open\Command C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %*
HKEY_CLASSES_ROOT \piffile\shell\open\command "%1" %*


Top

Registry - Active Setup
Hauptschlüssel
(Rootkey) Schlüssel Wert Inhalt
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\SetupcPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SetupcPerUser 64 C:\WINDOWS\INF\setupc.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\AppletsPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection AppletsPerUser 64 C:\WINDOWS\INF\applets.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_CVT_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\FontsPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection FontsPerUser 64 C:\WINDOWS\INF\fonts.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_HNW_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 C:\WINDOWS\INF\ICS.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_ICW_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICW_Inis 0 C:\WINDOWS\INF\icw97.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4395} StubPath regsvr32.exe /s /n /i:U shell32.dll
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_moviemaker StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 C:\WINDOWS\INF\moviemk.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{CA0A4247-44BE-11d1-A005-00805F8ABE06} StubPath RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Msinfo StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo 64 C:\WINDOWS\INF\msinfo.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Msinfo2 StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo2 64 C:\WINDOWS\INF\msinfo.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MotownMmsysPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMmsysPerUser 64 C:\WINDOWS\INF\motown.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MotownAvivideoPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownAvivideoPerUser 64 C:\WINDOWS\INF\motown.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Base StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Base 64 C:\WINDOWS\INF\msmail.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\SamplerPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 C:\WINDOWS\INF\sampler.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\ShellPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection ShellPerUser 64 C:\WINDOWS\INF\shell.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\Shell2PerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell2PerUser 64 C:\WINDOWS\INF\shell2.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_winbase_Links StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winbase_Links 64 C:\WINDOWS\INF\subase.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_winapps_Links StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winapps_Links 64 C:\WINDOWS\INF\subase.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_LinkBar_URLs StubPath C:\WINDOWS\COMMAND\sulfnbk.exe /L
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\TapiPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection TapiPerUser 64 C:\WINDOWS\INF\tapi.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_MSWordPad_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 C:\WINDOWS\INF\wordpad.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUserOldLinks StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUserOldLinks 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MmoptRegisterPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRegisterPerUser 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_CDPlayer_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\OlsPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsPerUser 64 C:\WINDOWS\INF\ols.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_PCHealth StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PCHealth 64 C:\WINDOWS\INF\pchealth.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} StubPath
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} StubPath rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mswmp.inf,PerUserStub
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} StubPath rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Paint_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Paint_Inis 64 C:\WINDOWS\INF\applets.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Calc_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Calc_Inis 64 C:\WINDOWS\INF\applets.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_dxxspace_Links StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_dxxspace_Links 64 C:\WINDOWS\INF\applets1.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Enable_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Enable_Inis 64 C:\WINDOWS\INF\enable.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Wingames_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Wingames_Inis 64 C:\WINDOWS\INF\games.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_ZoneGame_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ZoneGame_Inis 64 C:\WINDOWS\INF\games.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_PBGame_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PBGame_Inis 64 C:\WINDOWS\INF\games.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be} StubPath rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Remove.PerUser
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MotownRecPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser 64 C:\WINDOWS\INF\motown.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Vol StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Vol 64 C:\WINDOWS\INF\motown.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MotownMPlayPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 C:\WINDOWS\INF\motown.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_RNA_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_RNA_Inis 64 C:\WINDOWS\INF\rna.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Sysmon_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmon_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Sysmeter_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Sysmeter_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_netwatch_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_netwatch_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_CharMap_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CharMap_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Onlinelnks_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Onlinelnks_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Dialer_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Dialer_Inis 64 C:\WINDOWS\INF\appletpp.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_ClipBrd_Inis StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ClipBrd_Inis 64 C:\WINDOWS\INF\clip.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MmoptMusicaPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptMusicaPerUser 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MmoptJunglePerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptJunglePerUser 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MmoptRobotzPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRobotzPerUser 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\MmoptUtopiaPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptUtopiaPerUser 64 C:\WINDOWS\INF\mmopt.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015C} StubPath rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.W95
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} StubPath "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} StubPath "C:\PROGRA~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\OlsAolPerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsAolPerUserRemove 64 C:\WINDOWS\INF\ols.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\Shell3PerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell3PerUser 64 C:\WINDOWS\INF\shell3.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\Theme_MoreWindows_PerUser StubPath rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Themes_MoreWindows_PerUser 0 C:\WINDOWS\INF\themes.inf
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\PerUser_Preptool StubPath rundll.exe Setupx.dll,InstallHinfSection Install 64 C:\WINDOWS\INF\RUNLAST.INF
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{44BBA851-CC51-11CF-AAFA-00AA00B6015C} StubPath rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wpie5x86.inf,PerUserStub
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} StubPath C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} StubPath C:\WINDOWS\SYSTEM\ie4uinit.exe
HKEY_LOCAL_MACHINE \Software\Microsoft\Active Setup\Installed Components\&gt;{B2188463-6606-11D4-B5C3-00A0C94BF862}TBC959 StubPath RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP


Top

Registry - Virtuelle Gerätetreiber (VxD)
Hauptschlüssel
(Rootkey) Schlüssel Wert Inhalt
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VNETSUP StaticVxD vnetsup.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VPOWERD StaticVxD *VPOWERD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\NDIS StaticVxD ndis.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\JAVASUP StaticVxD JAVASUP.VXD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\CONFIGMG StaticVxD *CONFIGMG
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\NTKern StaticVxD *NTKERN
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VWIN32 StaticVxD *VWIN32
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VFBACKUP StaticVxD *VFBACKUP
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VCOMM StaticVxD *VCOMM
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\COMBUFF StaticVxD *COMBUFF
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\IFSMGR StaticVxD *IFSMGR
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\IOS StaticVxD *IOS
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\MTRR StaticVxD *MTRR
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\SPOOLER StaticVxD *SPOOLER
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\UDF StaticVxD *UDF
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VFAT StaticVxD *VFAT
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VCACHE StaticVxD *VCACHE
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VCOND StaticVxD *VCOND
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VCDFSD StaticVxD *VCDFSD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VXDLDR StaticVxD *VXDLDR
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VDEF StaticVxD *VDEF
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VPICD StaticVxD *VPICD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VTD StaticVxD *VTD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\REBOOT StaticVxD *REBOOT
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VDMAD StaticVxD *VDMAD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VSD StaticVxD *VSD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\V86MMGR StaticVxD *V86MMGR
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\PAGESWAP StaticVxD *PAGESWAP
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\DOSMGR StaticVxD *DOSMGR
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VMPOLL StaticVxD *VMPOLL
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\SHELL StaticVxD *SHELL
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\PARITY StaticVxD *PARITY
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\BIOSXLAT StaticVxD *BIOSXLAT
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VMCPD StaticVxD *VMCPD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VTDAPI StaticVxD *VTDAPI
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\PERF StaticVxD *PERF
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VIAGART StaticVxD viagart.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VxDMon StaticVxD *VxDMon
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VREDIR StaticVxD vredir.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\DFS StaticVxD dfs.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\VSDATA95 StaticVxD vsdata95.vxd
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\SYMEVNT StaticVxD C:\PROGRA~1\SYMANTEC\SYMEVNT.386
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\NAVAP StaticVxD C:\PROGRA~1\NORTON~1\NAVAP.VXD
HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\SYMTDI StaticVxD SYMTDI.VXD


Top

Registry - ICQ Net
Hauptschlüssel
(Rootkey) Schlüssel Wert Inhalt


Top

Autostart - Standardeinträge
Pfad Dateiname Link zu
C:\WINDOWS\Startmenü\Programme\Autostart\ ERINNERUNGEN FÜR MICROSOFT WORKS-KALENDER.LNK C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\Startmenü\Programme\Autostart\ MICROSOFT OFFICE.LNK C:\Programme\Microsoft Office\Office\OSA9.EXE
C:\WINDOWS\Startmenü\Programme\Autostart\ OnlineCounter 2004-Autostart.lnk C:\Programme\OnlineCounter 2004\OnlineCounter-Autostart.exe
C:\WINDOWS\All Users\Startmenü\Programme\Autostart\ ZONEALARM PRO.LNK C:\Programme\Zone Labs\ZoneAlarm\zapro.exe


Top

INI Dateien
Dateiname Wert Inhalt
C:\WINDOWS\win.ini load ptsnoop.exe
C:\WINDOWS\win.ini run
C:\WINDOWS\system.ini shell Explorer.exe


Top

Batch und Text Dateien
Dateiname Inhalt
c:\msdos.sys [Paths]
WinDir=C:\WINDOWS
WinBootDir=C:\WINDOWS
HostWinBootDrv=C

[Options]
BootMulti=1
BootGUI=1
;
;The following lines are required for compatibility with other programs.
;Do not remove them (MSDOS.SYS needs to be &gt;1024 bytes).
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxa
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxb
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxc
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxd
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxe
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxf
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxg
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxh
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxi
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxj
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxk
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxl
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxm
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxn
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxq
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxr
;xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxs
AutoScan=1
WinVer=4.90.3000


C:\WINDOWS\winstart.bat @C:\WINDOWS\tmpcpyis.bat

C:\WINDOWS\command\cmdinit.bat @echo off
doskey /insert &gt; nul

c:\autoexec.bat SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\PROGRA~1\ETIKET~1;C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

c:\config.sys Kein Inhalt


Top

EXPLORER.EXE in C:\

[ 11. Oktober 2003, 17:04: Beitrag editiert von: horoc ]

Na dann fang ich mal an:

1. Ich würde auf jeden Fall mal den Eintrag für ptsnoop.exe rauswerfen. Selbst für das Funktionieren eines Softmodems braucht man IMHO keine exe Datei. Also Eintrag raus aus der win.ini und die exe am besten zippen und entfernen. Die zip datei irgendwo aufheben, falls doch was wichtiges nicht funktionieren sollte.

2. Was mir nichts sagt ist: "HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices RegisterDropHandler C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE". Was ist denn ScannerU?

Zu ptsnoop.exe:
Habe im für mich lesbaren Teil der Datei folgendes gefunden
- This program requires Microsoft Windows
- PCtelSnoop
- SuRegQueryValueEx.Software\PCTel\HSPModem\Settings

Die beiden Einträge zu 2) gehören zu meinem Plustek-Scanner. Dind Bestandteil des mit dem Scanner mitinstallierten Texterkennungsprogramms,was ich nie nutze.

[ 11. Oktober 2003, 18:18: Beitrag editiert von: horoc ]

Im WIN:INI-Editor steht folgender Eintrag:

(Windows)
load ptsnoop.exe
run=
Nullport=None
device=CanonBJC2000, CJRSTR, LPT1:

Das betrifft meinen Drucker und läßt somit das Ganze in einem neuen Licht erscheinen ?

Hast Du die ptsnoop.exe mal mit den Kaspersky Remote Check untersucht?

</font><blockquote>Zitat:</font><hr />Original erstellt von Bo Derek:

2. Was mir nichts sagt ist: "HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\RunServices RegisterDropHandler C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE". Was ist denn ScannerU? </font>[/QUOTE]Sowas änliches kenn ich von meinem Scanner. TBRIDGE ist TextBridge (gescannten Text verarbeiten). Also normal.