|
Log-Analyse und Auswertung: Unerwünschte WebsitesWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
18.01.2008, 18:57 | #1 |
| Unerwünschte Websites Wenn ich im Internet surfe öffnen sich jedesmal diverse Seiten, ohne das ich was mache...Seiten wie flirt fever, craz girls usw....Seiten von denen ich noch nie zuvor gehört habe. Wäre nett wenn mir jemand weiterhelfen könnte Logfile of HijackThis v1.99.1 Scan saved at 18:53:41, on 18.01.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\Programme\Home Cinema\PowerCinema\PCMService.exe C:\Programme\DAEMON Tools\daemon.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe C:\Programme\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\T-Online\ISDNSP~1\Tomcat.exe C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\dokumente und einstellungen\christopher\lokale einstellungen\anwendungsdaten\avqdpkgzna.exe C:\Programme\MessengerSkinner\MessengerSkinner.exe C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe C:\Programme\HP\Digital Imaging\bin\hpqimzone.exe C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Programme\CyberLink\Shared Files\RichVideo.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\kernel.exe C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis2\sc_watch.exe C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE C:\PROGRA~1\T-Online\T-ONLI~1\Notifier\Notifier.exe C:\Programme\QIP8\qip.exe C:\Programme\MSN Messenger\msnmsgr.exe C:\Programme\MSN Messenger\usnsvc.exe C:\Programme\AdwareRemoverGold.com\Adware Remover Gold\AdGold.exe C:\Programme\Internet Explorer\iexplore.exe C:\DOKUME~1\CHRIST~1\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Programme\MyGlobalSearch\bar\1.bin\MGSBAR.DLL O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\Windows Live Toolbar\msntb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ISDN SpeedManager] "C:\PROGRA~1\T-Online\ISDNSP~1\Tomcat.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [avqdpkgzna] c:\dokumente und einstellungen\christopher\lokale einstellungen\anwendungsdaten\avqdpkgzna.exe avqdpkgzna O4 - HKCU\..\Run: [messengerskinner] C:\Programme\MessengerSkinner\MessengerSkinner.exe O4 - HKCU\..\Run: [Instant Access] C:\WINDOWS\system32\nsinet.exe /res O4 - HKCU\..\RunOnce: [SWHelper] "C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1010011 O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Photosmart Premier – Schnellstart.lnk = C:\Programme\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: &Windows Live Search - res://C:\Programme\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra button: MedionShop - {53000F2D-5A8A-4674-95EB-F79F5305224C} - http://www.medionshop.de/ (file missing) (HKCU) O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O10 - Unknown file in Winsock LSP: c:\programme\adwareremovergold.com\adware remover gold\apptoport.dll O11 - Options group: [INTERNATIONAL] International* O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/ O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1131703638421 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131707441843 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.schuelervz.net/photouploader/ImageUploader4.cab O16 - DPF: {DF1C8E21-4045-4D67-B528-335F1A4F0DE9} - http://es6-scripts.dlv4.com/binaries/egaccess4/egaccess4_1073_em_XP.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{2075C0AC-3CF0-4C4A-86CB-9D1B40B24F6F}: NameServer = 217.237.150.51 217.237.148.22 O17 - HKLM\System\CCS\Services\Tcpip\..\{2F4BFF00-682E-4656-B527-885A54B24731}: NameServer = 192.168.0.178 O17 - HKLM\System\CCS\Services\Tcpip\..\{60870B0C-5690-42E2-96C3-6EA2D6D8BBA6}: NameServer = 192.168.0.69,192.168.0.57 O17 - HKLM\System\CCS\Services\Tcpip\..\{CFEC4411-BB17-4A02-B04E-B0586A77107C}: NameServer = 192.168.0.64,192.168.0.59 O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: ipsemsw3.dll O20 - Winlogon Notify: msormsxm - C:\WINDOWS\system32\msormsxm.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\CyberLink\Shared Files\RichVideo.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe |
Themen zu Unerwünschte Websites |
adobe, appinit_dlls, askbar, bho, diverse, diverse seiten, drivers, einstellungen, excel, explorer, fever, flirt, flirt fever, google, helper, hijack, hijackthis, home, internet, internet explorer, kaspersky, microsoft, nvidia, pdf, programme, rundll, seiten, shockwave, software, system, t-online, temp, unknown file in winsock lsp, urlsearchhook, windows, windows xp |