| |
| |||||||
Log-Analyse und Auswertung: Spyware Problem!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
03.05.2008, 21:52
| #1 |
 |  Spyware Problem! Hallo Forummitglieder, ich hab ein rießen Problem. Bei mir werden andauernd ungewollt Werbeseiten geöffnet bzw. Seiten wo mir gesagt wird das mein Computer infiziert ist. Da kommt dann in den Firefox Browser ein WindowsXP fenster wo der virtuel nach Spyware sucht und ca. 42 oder so findet. Meisten fordert er mich auch auf irgendetwas herunterzuladen. Bitte helft mir diese Spyware loszuwerden. Sodass keine Werbefenster mehr geöffnet werden. Hier meine Logfile Datei: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:23:13, on 03/05/2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Program Files (x86)\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Spiele\Program Files (x86)\Steam\Steam.exe C:\Windows\System32\spool\drivers\x64\3\E_FATIBVE.EXE C:\Windows\System32\spool\drivers\x64\3\E_FATIBVE.EXE C:\Program Files (x86)\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Anwendungen\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe C:\Anwendungen\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Anwendungen\Program Files (x86)\Xfire\xfire.exe C:\Anwendungen\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Lavasoft\Ad-Aware 2007\Ad-Aware2007.exe C:\Anwendungen\Program Files (x86)\HiJackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=ZillaPopupKiller:8100 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll R3 - URLSearchHook: Techno4ever Toolbar - {fb7d98cb-b228-4ecb-acac-e7101156338e} - C:\Program Files (x86)\Techno4ever\tbTec1.dll F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ANWEND~1\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files (x86)\google\googletoolbar1.dll O2 - BHO: Techno4ever Toolbar - {fb7d98cb-b228-4ecb-acac-e7101156338e} - C:\Program Files (x86)\Techno4ever\tbTec1.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~2\ICQTOO~1\toolbaru.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Techno4ever Toolbar - {fb7d98cb-b228-4ecb-acac-e7101156338e} - C:\Program Files (x86)\Techno4ever\tbTec1.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files (x86)\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [avgnt] "C:\Anwendungen\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files (x86)\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\Windows\is-2SANG.exe" /REG O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files (x86)\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "c:\spiele\program files (x86)\steam\steam.exe" -silent O4 - HKCU\..\Run: [\\ARBEIT\EPSON Stylus DX5000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\***\AppData\Local\Temp\E_SF5D2.tmp" /EF "HKCU" O4 - HKCU\..\Run: [\\CK-FKK55XSWHDCY\EPSON Stylus DX5000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\***\AppData\Local\Temp\E_SDA0E.tmp" /EF "HKCU" O4 - HKCU\..\Run: [EPSON Stylus DX5000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Windows\TEMP\E_SF0F9.tmp" /EF "HKCU" O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Anwendungen\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [\ARBEIT\EPSON Stylus DX5000 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\***\AppData\Local\Temp\E_SF5D2.tmp" /EF "HKCU" O4 - HKCU\..\Run: [Zilla Popup Killer] C:\Program Files (x86)\Zilla Popup Killer\ZillaPop.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files (x86)\ICQLite\ICQLite.exe -trayboot O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: Xfire.lnk = C:\Anwendungen\Program Files (x86)\Xfire\xfire.exe O8 - Extra context menu item: &Winamp Toolbar Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: eBay Startseite - {8B69DB2E-015D-4c4f-B97E-95EF5326BDA8} - h**p://adfarm.mediaplex.com/ad/ck/707-1170-5704-77?RedirectEnter&partner=36420&loc=h**p://pages.ebay.de (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ANWEND~1\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ANWEND~1\PROGRA~1\SPYBOT~1\SDHelper.dll O13 - Gopher Prefix: O15 - Trusted Zone: http://www.google.de O15 - Trusted Zone: http://download.windowsupdate.com O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - h**p://static.ak.schuelervz.net/photouploader/ImageUploader4.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - h**p://treff-mogelpower.spaces.live.com/PhotoUpload/VistaMsnPUpldde-de.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: bw+0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll Fortsetzung folgt... |
|
03.05.2008, 21:53
| #2 |
| | Spyware Problem! ...Hier der restliche Teil!
__________________ O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: offline-8876480 - {5DECA9CA-BC61-4C3A-89BA-A67A03379B74} - C:\Anwendungen\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Anwendungen\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Anwendungen\Program Files (x86)\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe O23 - Service: Process Monitor (LVPrcS64) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: NBService - Nero AG - C:\Anwendungen\Program Files (x86)\Nero 7\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ProtexisLicensing - Unknown owner - C:\Windows\SysWOW64\PSIService.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Anwendungen\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 27085 bytes mfg Luke |
|
03.05.2008, 21:59
| #3 |
| Administrator > Competence Manager  |  Spyware Problem!Hallo Lukerunner und  Dateien Online überprüfen lassen:
Code:
ATTFilter
ComboFix
__________________ |
|
03.05.2008, 22:24
| #4 |
| | Spyware Problem! Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.5.3.0 2008.05.02 - AntiVir 7.8.0.11 2008.05.02 - Authentium 4.93.8 2008.05.02 - Avast 4.8.1169.0 2008.05.03 - AVG 7.5.0.516 2008.05.03 - BitDefender 7.2 2008.05.03 - CAT-QuickHeal 9.50 2008.05.03 - ClamAV 0.92.1 2008.05.03 - DrWeb 4.44.0.09170 2008.05.03 - eSafe 7.0.15.0 2008.04.28 - eTrust-Vet 31.3.5755 2008.05.03 - Ewido 4.0 2008.05.03 - F-Prot 4.4.2.54 2008.05.02 - F-Secure 6.70.13260.0 2008.05.03 - Fortinet 3.14.0.0 2008.05.03 - Ikarus T3.1.1.26 2008.05.03 - Kaspersky 7.0.0.125 2008.05.03 - McAfee 5287 2008.05.02 - Microsoft 1.3408 2008.04.22 - NOD32v2 3072 2008.05.03 - Norman 5.80.02 2008.05.02 - Panda 9.0.0.4 2008.05.03 - Prevx1 V2 2008.05.03 - Rising 20.42.22.00 2008.04.30 - Sophos 4.29.0 2008.05.03 - Sunbelt 3.0.1097.0 2008.05.03 - Symantec 10 2008.05.03 - TheHacker 6.2.92.300 2008.05.03 - VBA32 3.12.6.5 2008.05.03 - VirusBuster 4.3.26:9 2008.05.03 - Webwasher-Gateway 6.6.2 2008.05.03 - weitere Informationen File size: 27087 bytes MD5...: 26de3115ecc395f059324f8005f1eafb SHA1..: 1e1c31741b8bd2a2e67b85031ad2e6dc028edbfe SHA256: 61ed26941288ed8c29c09ee0633059ccf05338c745a7b53b940fe20876fe8093 SHA512: 1e59068ffbe545e436f4467479946aa18b0cfae31ee0eba36c2d5b5083d35c1b<br>debc2e43590b0c24bde3728c3b3b7fa46db370634d8b8a265aa1a613ad44cdde PEiD..: - PEInfo: - |
|
03.05.2008, 22:30
| #5 |
| | Spyware Problem! Es gibt ein Problem... ComboFix läuft nur unter Windows 2000 oder XP und ich hab Vista x64. mfg Luke |
|
03.05.2008, 22:33
| #6 | |
| Administrator > Competence Manager | Spyware Problem!Zitat:
 Oder kommt diese Meldung direkt vom Programm Combofix?
__________________ --> Spyware Problem! |
|
| Themen zu Spyware Problem! |
| ad-aware, antivir, avira, bho, browser, c:\windows\temp, computer, desktop, drivers, ebay, firefox, google, helper, hijack, hijackthis, internet, internet explorer, local\temp, logfile, mozilla, mozilla firefox, object, problem, programdata, senden, shockwave, software, spyware, system, urlsearchhook, vista, werbefenster, windows sidebar, windows\temp |
Hybrid-Darstellung
