| |
| |||||||
Log-Analyse und Auswertung: Problem System Error. Updates funktionieren nichtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
15.06.2008, 12:58
| #1 |
| |  Problem System Error. Updates funktionieren nicht Hallo habe ein Problem. Immer wenn ich ins Internet will kommt folgende Fehlermeldung!: Siehe Anhang! System Error! Attention! Some dangerous trojan horses detected in your System. Microdoft Windows XP files corrupted. This may lead to the destruction of important files in C:\\WINDOWS. Download protection Software now! Click oK to download the antispyware. Wenn ich auf OK klicke will es IEAV.exe runterladen. Habe ich natürlich nicht gemacht!! Ist nur beim IE so, mit Firefox gehts!! Beim IE fliege ich nach einiger Zeit auch raus!!  Und wenn ich auf google gehe und einen Suchbegriff eingebe kommt das Hier: !!Siehe Anhang!! Außerdem lassen sich die Windows Updates nicht mehr installieren. Runterladen ja, aber dann kommt die Meldung: Folgende Updates wurden nicht installiert.... Hier mal die HijackLog: Logfile of Trend Micro HijackThis v2.0.2 [edit] bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird: http://www.trojaner-board.de/22771-a...tml#post171958 danke GUA  [/edit] |
|
15.06.2008, 12:59
| #2 |
| |  Problem System Error. Updates funktionieren nicht Hier noch COMBOFIX Log:
__________________ComboFix 08-06-11.7 - OpTiKinG 2008-06-15 12:17:00.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.551 [GMT 2:00] ausgeführt von:: C:\Dokumente und Einstellungen\OpTiKinG\Desktop\Alles Mögl\Programme\Setups\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt * Resident AV is active . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\smp.bat C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows Media\10.0\WMSDKNSD.XML . ((((((((((((((((((((((( Dateien erstellt von 2008-05-15 bis 2008-06-15 )))))))))))))))))))))))))))))) . 2008-06-15 00:18 . 2006-05-05 11:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys 2008-06-14 22:22 . 2008-06-14 22:22 <DIR> d-------- C:\Programme\Ashampoo 2008-06-14 22:03 . 2004-08-04 14:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-06-14 22:02 . 2004-08-04 14:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-06-14 21:57 . 2008-06-14 23:12 <DIR> d-------- C:\WINDOWS\LastGood 2008-06-14 21:56 . 2008-06-14 21:56 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest 2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest 2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest 2008-06-14 21:55 . 2008-06-14 21:55 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest 2008-06-14 19:51 . 2008-06-15 01:15 <DIR> d-------- C:\Programme\Spyware Doctor 2008-06-14 19:51 . 2008-06-14 19:51 <DIR> d-------- C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\PC Tools 2008-06-14 19:51 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys 2008-06-14 19:51 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys 2008-06-14 19:51 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys 2008-06-14 19:51 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys 2008-06-13 23:17 . 2008-06-13 23:17 281,088 --a------ C:\WINDOWS\topost8x.dll 2008-06-13 17:00 . 2008-06-13 17:00 <DIR> dr------- C:\Dokumente und Einstellungen\LocalService\Favoriten 2008-06-12 22:48 . 2008-06-12 22:48 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten\Nero 2008-06-12 22:47 . 2007-03-31 15:31 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Vorlagen 2008-06-12 22:47 . 2006-09-05 16:14 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Startmenü 2008-06-12 22:47 . 2006-09-05 16:17 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Netzwerkumgebung 2008-06-12 22:47 . 2008-06-15 12:22 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Lokale Einstellungen 2008-06-12 22:47 . 2008-06-12 22:47 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Favoriten 2008-06-12 22:47 . 2008-06-12 22:47 <DIR> dr------- C:\Dokumente und Einstellungen\Pascal\Eigene Dateien 2008-06-12 22:47 . 2006-09-05 16:17 <DIR> d--h----- C:\Dokumente und Einstellungen\Pascal\Druckumgebung 2008-06-12 22:47 . 2006-09-05 16:23 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten\ATI 2008-06-12 22:47 . 2008-06-12 22:48 <DIR> dr-h----- C:\Dokumente und Einstellungen\Pascal\Anwendungsdaten 2008-06-12 22:47 . 2008-06-12 22:47 <DIR> d-------- C:\Dokumente und Einstellungen\Pascal 2008-06-12 21:49 . 2004-08-04 14:00 1,086,058 -ra------ C:\WINDOWS\SETDF.tmp 2008-06-10 19:03 . 2008-06-10 20:52 594 --ahs---- C:\WINDOWS\system32\efxqcfox.ini 2008-06-05 21:11 . 2008-06-05 21:11 <DIR> d-------- C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\Smart PC Solutions 2008-06-05 20:56 . 2008-06-05 21:11 <DIR> d-------- C:\Programme\Smart PC Solutions 2008-06-05 20:56 . 2008-06-05 20:56 <DIR> d-------- C:\Programme\Recuva 2008-06-05 18:10 . 2008-06-05 18:10 <DIR> d-------- C:\Programme\OO Software 2008-06-03 23:01 . 2008-06-03 23:01 <DIR> d-------- C:\phenomedia 2008-05-31 20:37 . 2008-06-09 22:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-31 20:37 . 2008-05-31 20:37 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-29 17:15 . 2008-05-29 17:15 <DIR> d-------- C:\Programme\Beneton Movie GIF 2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\WINDOWS\PreviewSoft 2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\WINDOWS\Noslip 2008-05-27 23:26 . 2008-05-27 23:26 <DIR> d-------- C:\Programme\Ulead Systems 2008-05-27 23:26 . 2008-05-27 23:26 4,808 --a------ C:\WINDOWS\system32\gaeffect.sti 2008-05-27 23:26 . 2008-05-27 23:26 3,176 --a------ C:\WINDOWS\system32\gafilter.sti 2008-05-27 23:26 . 2008-05-31 16:58 528 --ah----- C:\os466477.bin 2008-05-27 23:26 . 2008-05-31 16:58 513 --ah----- C:\WINDOWS\system32\ws344069.ocx 2008-05-27 23:26 . 2008-05-31 16:58 326 --a------ C:\WINDOWS\ULEAD32.INI 2008-05-22 21:07 . 2008-05-22 21:07 <DIR> d-------- C:\Programme\QIP 2008-05-22 15:11 . 2008-05-22 15:11 <DIR> d-------- C:\Programme\HDD Health 2008-05-22 15:06 . 2008-05-22 15:06 <DIR> d-------- C:\Programme\HD Tune 2008-05-17 20:45 . 2008-05-17 20:45 <DIR> d-------- C:\Programme\Eidos 2008-05-17 20:44 . 2008-05-17 20:44 <DIR> d-------- C:\WINDOWS\system32\xlive . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-14 23:35 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\LimeWire 2008-06-14 23:18 --------- d---a-w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP 2008-06-14 23:17 --------- d-----w C:\Programme\AVIConverter 2008-06-14 19:54 1,691 ----a-w C:\WINDOWS\inf\COM122.tmp 2008-06-14 17:38 --------- d-----w C:\Programme\PokerStars 2008-06-12 20:26 1,691 ----a-w C:\WINDOWS\inf\COM11A.tmp 2008-06-09 13:20 --------- d-----w C:\Programme\Activision 2008-06-05 19:08 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\DivX 2008-06-01 16:35 --------- d-----w C:\Programme\PokerStars.NET 2008-05-30 22:34 --------- d-----w C:\Programme\Sony Ericsson 2008-05-30 22:34 --------- d-----w C:\Programme\Gemeinsame Dateien\Teleca Shared 2008-05-27 21:26 --------- d--h--w C:\Programme\InstallShield Installation Information 2008-05-14 16:15 --------- d-----w C:\Programme\Gemeinsame Dateien\Macromedia Shared 2008-05-14 16:14 --------- d-----w C:\Programme\Gemeinsame Dateien\Macromedia 2008-05-14 16:13 --------- d-----w C:\Programme\Macromedia 2008-05-12 17:49 --------- d-----w C:\Programme\Gemeinsame Dateien\PokerStars.com 2008-05-10 15:49 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DVD Shrink 2008-05-07 15:30 --------- d-----w C:\Programme\LimeWire 2008-05-05 21:15 --------- d-----w C:\Programme\Advanced GIF Animator 2008-05-05 21:06 --------- d-----w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\Obsidium 2008-05-04 10:04 --------- d-----w C:\Programme\Virtual Earth 3D 2008-04-30 15:28 --------- d-----w C:\Programme\DivX 2008-04-30 15:24 --------- d-----w C:\Programme\Google 2008-04-28 19:23 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-04-28 19:23 --------- d-----w C:\Programme\Gemeinsame Dateien\xing shared 2008-04-28 19:23 --------- d-----w C:\Programme\Gemeinsame Dateien\Real 2008-04-26 15:46 --------- d-----w C:\Programme\Ubi Soft 2008-04-26 15:42 --------- d-----w C:\Programme\Red Storm Entertainment 2008-04-19 13:00 8,192 --sha-w C:\WINDOWS\o2cLicStore.bin 2008-04-18 15:56 --------- d-----w C:\Programme\EA SPORTS 2008-04-18 10:24 --------- d-----w C:\Programme\Picture It! Premium 10 2008-03-31 21:25 831,488 ----a-w C:\WINDOWS\system32\divx_xx0a.dll 2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll 2008-03-31 21:25 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll 2008-03-31 21:25 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll 2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\DivX.dll 2008-03-31 21:25 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-03-21 20:30 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe 2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll 2008-03-21 20:30 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-03-21 20:30 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll 2008-03-21 20:28 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll 2008-03-21 20:28 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll 2008-03-21 20:28 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll 2008-03-21 20:28 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll 2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll 2008-03-21 20:28 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll 2008-03-21 20:28 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll 2008-03-21 20:28 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll 2006-10-08 10:20 234 ----a-w C:\Dokumente und Einstellungen\OpTiKinG\Anwendungsdaten\wklnhst.dat 2003-02-28 10:32 11,776 ----a-w C:\WINDOWS\inf\dt154stickoem_wxp.exe 2002-11-14 20:32 55,808 ----a-w C:\WINDOWS\inf\devcon154stick.exe . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}] 2008-06-13 23:17 281088 --a------ C:\WINDOWS\topost8x.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}] C:\WINDOWS\system32\cxtirkkd.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2006-12-30 22:30 40960] "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="REM C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "\\WOHNZIMMER\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304] "Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304] "avgnt"="C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-19 14:36 262401] "ATICCC"="C:\Programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016] "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304] "\\lt-wohnzimmer\EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304] "NeroFilterCheck"="C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136] "NBKeyScan"="C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 15:21 2213160] "TkBellExe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-04-28 21:23 185896] "BMbf38a165"="C:\WINDOWS\system32\pjmmgujp.dll" [ ] "RTHDCPL"="RTHDCPL.EXE" [2006-06-28 14:54 16248320 C:\WINDOWS\RTHDCPL.EXE] "SkyTel"="SkyTel.EXE" [2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe] "AntiSpyWare2Guard"="C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2007-07-18 03:35 2327040] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 14:00 44544] C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\ Microsoft Office.lnk - C:\Programme\Microsoft Office\Office\OSA9.EXE [1999-04-29 23:00:00 65588] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb] awtrRlIb.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg21.dll "VIDC.PIM1"= pclepim1.dll [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Google Updater.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Sinus 154 stick WLAN Manager.lnk] path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Sinus 154 stick WLAN Manager.lnk backup=C:\WINDOWS\pss\Sinus 154 stick WLAN Manager.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BearShare] C:\Programme\BearShare\BearShare.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] --a------ 2006-11-12 12:48 157592 C:\Programme\DAEMON Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2008-04-30 17:24 157696 C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite] --a------ 2006-07-11 12:15 3144800 C:\Programme\ICQLite\ICQLite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Meta Default Ref Online] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ball Dash Meta Default\teamblah.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mouse-o-meter] C:\WINDOWS\TEMP\MOUSE.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 18:24 1694208 C:\Programme\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Muscbrigade] --a------ 2005-12-20 10:18 40960 c:\Musicbrigade\Musicbrigade.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Programme\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray] C:\Programme\Spyware Doctor\SDTrayApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] --a------ 2006-05-16 18:04 2879488 C:\WINDOWS\SkyTel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-06-13 18:19 68856 C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-04-28 21:23 185896 C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2007-10-10 07:28 36352 C:\Programme\Winamp1\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowSect] C:\DOKUME~1\OpTiKinG\ANWEND~1\ONCEAI~1\Jump Glue.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlogons.exe] C:\Programme\Free KGB Key Logger\winlogons.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{BC0B9256-088C-1031-0815-060510060031}] C:\Programme\Gemeinsame Dateien\{BC0B9256-088C-1031-0815-060510060031}\Update.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "gusvc"=2 (0x2) "SPYWAREfighterRP"=3 (0x3) "StyleXPService"=2 (0x2) "SBCSSvc"=2 (0x2) "AVG Anti-Spyware Guard"=2 (0x2) "FirebirdServerMAGIXInstance"=3 (0x3) "Bonjour Service"=2 (0x2) "sdCoreService"=2 (0x2) "sdAuxService"=2 (0x2) "PnkBstrA"=2 (0x2) "NMIndexingService"=3 (0x3) "LYUIVJC"=3 (0x3) "FLEXnet Licensing Service"=3 (0x3) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\czero.exe"= "C:\\Programme\\LimeWire\\LimeWire.exe"= "C:\\Programme\\EA GAMES\\Need for Speed Underground 2\\speed2.exe"= "C:\\Programme\\Valve\\hlds.exe"= "C:\\Programme\\Valve\\hl.exe"= "C:\\Programme\\DATA BECKER\\America Gold Edition\\America.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Programme\\EA GAMES\\Need for Speed Most Wanted\\speed_loader.exe"= "C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\hlds.exe"= "C:\\Dokumente und Einstellungen\\OpTiKinG\\Desktop\\Counterstike Condition Zero\\Condition Zero\\hltv.exe"= "C:\\Programme\\ICQLite\\ICQLite.exe"= "C:\\Programme\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"= "C:\\MAGIX\\mp3_maker_2005_SE\\mp3maker.exe"= "C:\\Programme\\EA SPORTS\\FIFA 07\\fifa07.exe"= "C:\\Programme\\Trillian\\trillian.exe"= "C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"= "C:\\Programme\\Eidos Interactive\\Gut Gemischt 2\\GutGemischt2.exe"= "C:\\Programme\\Messenger\\msmsgs.exe"= "C:\\Programme\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"= "C:\\Programme\\Midway Games\\Stranglehold\\Binaries\\Retail-Stranglehold.exe"= "C:\\Programme\\EA SPORTS\\FIFA 08\\FIFA08.exe"= "C:\\Programme\\World of Padman\\wop.exe"= "C:\\Programme\\Electronic Arts\\Need for Speed ProStreet\\nfs.exe"= "C:\\Programme\\Bonjour\\mDNSResponder.exe"= "C:\\Programme\\Eidos\\Kane and Lynch Dead Men\\kaneandlynch.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "C:\\Programme\\Internet Explorer\\IEXPLORE.EXE"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3587:TCP"= 3587:TCP:Windows-Peer-zu-Peer-Gruppierung "3540:UDP"= 3540:UDP:Peer Name Resolution-Protokoll (PNRP) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundEchoRequest"= 1 (0x1) R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2007-07-18 15:11] R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [2005-11-15 13:02] R3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2007-08-24 16:44] S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [2005-11-24 12:36] S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys [2006-12-14 01:39] S3 p2pgasvc;Peernetzwerk-Gruppenauthentifizierung;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00] S3 p2pimsvc;Peernetzwerkidentitäts-Manager;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00] S3 p2psvc;Peernetzwerk;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00] S3 PNRPSvc;Peer Name Resolution-Protokoll;C:\WINDOWS\system32\svchost.exe [2004-08-04 14:00] S3 UPnPService;UPnPService;C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 18:00] S3 Wdm1;Vivanco USB Link Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2002-11-18 08:00] S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Programme\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 16:18] S4 LYUIVJC;LYUIVJC;C:\DOKUME~1\OpTiKinG\LOKALE~1\Temp\LYUIVJC.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc *Newly Created Service* - CATCHME . Inhalt des "geplante Tasks" Ordners "2008-06-15 05:00:00 C:\WINDOWS\Tasks\AED15AE891CECD54.job" - c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-15 12:22:47 Windows 5.1.2600 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostart Einträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . Zeit der Fertigstellung: 2008-06-15 12:27:20 ComboFix-quarantined-files.txt 2008-06-15 10:26:34 ComboFix2.txt 2008-06-13 20:06:27 46 Verzeichnis(se), 173,052,149,760 Bytes frei 49 Verzeichnis(se), 173,095,686,144 Bytes frei 293 --- E O F --- 2008-06-15 00:01:33 BITTE HELFT MIR!!!! :aplaus:    :Boogie |
|
15.06.2008, 13:07
| #3 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Problem System Error. Updates funktionieren nicht Da ist aber einiges an Müll im System. Werte diese Dateien
__________________C:\WINDOWS\topost8x.dll C:\WINDOWS\system32\cxtirkkd.dll C:\WINDOWS\system32\pjmmgujp.dll C:\WINDOWS\system32\tscupgrd.exe bei virustotal.com aus und poste alle Ergebnisse. Laß danach auch mal Malwarebytes Anti-Malware durchlaufen, danach sehen wir weiter.
__________________ |
|
15.06.2008, 14:03
| #4 |
| | Problem System Error. Updates funktionieren nicht Datei topost8x.dll empfangen 2008.06.15 15:01:30 (CET) Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt Ergebnis: 5/32 (15.63%) Laden der Serverinformationen... Ihre Datei wartet momentan auf Position: ___. Geschätzte Startzeit is zwischen ___ und ___ . Dieses Fenster bis zum Abschluss des Scans nicht schließen. Der Scanner, welcher momentan Ihre Datei bearbeitet ist momentan gestoppt. Wir warten einige Sekunden um Ihr Ergebnis zu erstellen. Falls Sie längern als fünf Minuten warten, versenden Sie bitte die Datei erneut. Ihre Datei wird momentan von VirusTotal überprüft, Ergebnisse werden sofort nach der Generierung angezeigt. Filter Filter Drucken der Ergebnisse Drucken der Ergebnisse Datei existiert nicht oder dessen Lebensdauer wurde überschritten Dienst momentan gestoppt. Ihre Datei befindet sich in der Warteschlange (position: ). Diese wird abgearbeitet, wenn der Dienst wieder startet. SIe können auf einen automatischen reload der homepage warten, oder ihre email in das untere formular eintragen. Klicken Sie auf "Anfragen", damit das System sie benachrichtigt wenn die Überprüfung abgeschlossen ist. Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.6.13.1 2008.06.13 - AntiVir 7.8.0.55 2008.06.14 - Authentium 5.1.0.4 2008.06.14 - Avast 4.8.1195.0 2008.06.15 - AVG 7.5.0.516 2008.06.14 Adware Generic3.GSX BitDefender 7.2 2008.06.15 - CAT-QuickHeal 9.50 2008.06.14 - ClamAV 0.92.1 2008.06.15 - DrWeb 4.44.0.09170 2008.06.15 - eSafe 7.0.15.0 2008.06.12 - eTrust-Vet 31.6.5873 2008.06.14 - Ewido 4.0 2008.06.15 - F-Prot 4.4.4.56 2008.06.12 - F-Secure 6.70.13260.0 2008.06.14 - Fortinet 3.14.0.0 2008.06.15 - GData 2.0.7306.1023 2008.06.15 - Ikarus T3.1.1.26.0 2008.06.15 - Kaspersky 7.0.0.125 2008.06.15 - McAfee 5317 2008.06.13 - Microsoft 1.3604 2008.06.15 Trojan:Win32/Delflob.I NOD32v2 3187 2008.06.15 Win32/Adware.IeDefender.NFF Norman 5.80.02 2008.06.13 - Panda 9.0.0.4 2008.06.15 - Prevx1 V2 2008.06.15 Cloaked Malware Rising 20.48.61.00 2008.06.15 - Sophos 4.30.0 2008.06.15 - Sunbelt 3.0.1145.1 2008.06.05 - Symantec 10 2008.06.15 Downloader.MisleadApp TheHacker 6.2.92.350 2008.06.14 - VBA32 3.12.6.7 2008.06.14 - VirusBuster 4.3.26:9 2008.06.12 - Webwasher-Gateway 6.6.2 2008.06.15 - weitere Informationen File size: 281088 bytes MD5...: 62712854049f1caca4ca93edcafc9e84 SHA1..: 00c56ff6e48c74babbc0adfab28703c6dba5a726 SHA256: 5d5a7dca6f9261ee4a4ebfe06e0cc81527daf95461c9ba07e2159e97a7c16b10 SHA512: 519cab22b820af59524be5fa38bc35e926bb5d78b67ebadc2d8d0013a00de4f4 caf9b6e12ed4e8a67073c7bac7120f7851711674fb9ff1a8025057ed6661a6a9 PEiD..: ASPack v2.12 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4f0001 timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992) machinetype.......: 0x14c (I386) ( 10 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xc8000 0x34600 8.00 306eb99da2d939fd91d32770d2a834ac .itext 0xc9000 0x2000 0x800 7.37 06885af0c22a8df360486942b5d5c9cc .data 0xcb000 0x3000 0x1000 7.61 81f90720314bf5a8e54281c5172a2dd1 .bss 0xce000 0x4000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e .idata 0xd2000 0x3000 0xe00 7.93 2a8b7e14171171ef33d9c90f62dcbeb6 .edata 0xd5000 0x1000 0x200 1.87 63c08ace8d73089458810175aa699bd5 .reloc 0xd6000 0xc000 0x6800 7.99 161fb5a888c165a66507d846b09a7297 .rsrc 0xe2000 0xe000 0x5a00 7.59 19e59aba7135d6ec302d64f591e8bd43 .aspack 0xf0000 0x2000 0x1600 5.73 01466451b2772f390cda7ee8a462c7ca .adata 0xf2000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e ( 15 imports ) > kernel32.dll: GetProcAddress, GetModuleHandleA, LoadLibraryA > oleaut32.dll: SysFreeString > advapi32.dll: RegQueryValueExA > user32.dll: GetKeyboardType > user32.dll: CreateWindowExA > gdi32.dll: UnrealizeObject > version.dll: VerQueryValueA > advapi32.dll: RegSetValueExA > ole32.dll: IsEqualGUID > oleaut32.dll: CreateErrorInfo > ole32.dll: CreateStreamOnHGlobal > oleaut32.dll: SafeArrayPtrOfIndex > comctl32.dll: _TrackMouseEvent > shell32.dll: ShellExecuteA > advapi32.dll: ConvertStringSecurityDescriptorToSecurityDescriptorA ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer Prevx info: TOPOST16A.DLL - Prevx packers (Kaspersky): ASPack packers (F-Prot): Aspack |
|
15.06.2008, 14:11
| #5 |
| | Problem System Error. Updates funktionieren nicht die anderen find ich nich...  |
|
15.06.2008, 15:09
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Problem System Error. Updates funktionieren nicht Lösch mal bitte ein paar Sachen mit dem Avenger - geh dazu so vor aber kopiere ins Textfeld bei Input your here das hier rein: Code:
ATTFilter Files to delete:
C:\WINDOWS\SETDF.tmp
C:\WINDOWS\system32\efxqcfox.ini
C:\WINDOWS\system32\gafilter.sti
C:\os466477.bin
C:\WINDOWS\system32\ws344069.ocx
C:\WINDOWS\inf\COM122.tmp
C:\WINDOWS\inf\COM11A.tmp
C:\WINDOWS\system32\cxtirkkd.dll
C:\WINDOWS\system32\pjmmgujp.dll
C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe
C:\WINDOWS\Tasks\AED15AE891CECD54.job
c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe
C:\WINDOWS\topost8x.dll
C:\WINDOWS\system32\tscupgrd.exe
Registry keys to delete:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}
HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb
Registry values to delete:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | NCLaunch
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | BMbf38a165
HKLM\software\microsoft\windows nt\currentversion\winlogon\notify | awtrRlIb
Bearshare solltest Du unbedingt deinstallieren und nie wieder verwenden!! Limewire ist ebenso fragwürdig. Wenn Du munter weiter Tauschbörsen nutzt, um Dir Appz und Gamez  zu ziehen, mußt Du Dich nicht wundern, wenn Dein System die Pest bekommt.  Zitat:
 Bewußt installiert??Folge dann auch nochmal bitte dem Link zu silentrunner in meiner Signatur und poste das Logfile.
__________________ --> Problem System Error. Updates funktionieren nicht Geändert von root24 (15.06.2008 um 16:04 Uhr) Grund: kleine fehler im script korrigiert |
|
15.06.2008, 16:59
| #7 |
| | Problem System Error. Updates funktionieren nicht hab Malwarebytes durchlaufen lassen. jetzt is des problem schon weg!!  Soll ich trotzdem noch des mit dem avenger machen???PS: Bearshare ist schon ewig deinstalliert. Un der Keylogger war absicht is aber auch schon ewig deinstalliert!!!  |
|
15.06.2008, 17:20
| #8 |
| | Problem System Error. Updates funktionieren nicht ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Platform: Windows XP (build 2600, Service Pack 2) Sun Jun 15 18:06:50 2008 18:06:42: Error: Invalid registry syntax in command: "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NCLaunch" Only registry keys under the HKEY_LOCAL_MACHINE hive are accessible to this program. Skipping line. (Registry value deletion mode) ////////////////////////////////////////// Logfile of The Avenger Version 2.0, (c) by Swandog46 Swandog46's Public Anti-Malware Tools Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\SETDF.tmp" deleted successfully. File "C:\WINDOWS\system32\efxqcfox.ini" deleted successfully. File "C:\WINDOWS\system32\gafilter.sti" deleted successfully. File "C:\os466477.bin" deleted successfully. File "C:\WINDOWS\system32\ws344069.ocx" deleted successfully. File "C:\WINDOWS\inf\COM122.tmp" deleted successfully. File "C:\WINDOWS\inf\COM11A.tmp" deleted successfully. Error: file "C:\WINDOWS\system32\cxtirkkd.dll" not found! Deletion of file "C:\WINDOWS\system32\cxtirkkd.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\WINDOWS\system32\pjmmgujp.dll" not found! Deletion of file "C:\WINDOWS\system32\pjmmgujp.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe" not found! Deletion of file "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Temp\LYUIVJC.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "C:\WINDOWS\Tasks\AED15AE891CECD54.job" deleted successfully. Error: file "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" not found! Deletion of file "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: file "C:\WINDOWS\topost8x.dll" not found! Deletion of file "C:\WINDOWS\topost8x.dll" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist File "C:\WINDOWS\system32\tscupgrd.exe" deleted successfully. Error: registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}" not found! Deletion of registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B095AF15-2FB6-4239-95AD-D1E27ECC11C7}" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cb9c7c4a-4b05-4444-891e-7212708b68e0}" deleted successfully. Registry key "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\awtrRlIb" deleted successfully. Error: could not delete registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BMbf38a165" Deletion of registry value "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BMbf38a165" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Error: could not delete registry value "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify|awtrRlIb" Deletion of registry value "HKLM\software\microsoft\windows nt\currentversion\winlogon\notify|awtrRlIb" failed! Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND) --> the object does not exist Completed script processing. ******************* Finished! Terminate. Der Silent Runners.vbs Log passt hier nich rein!!!  |
|
15.06.2008, 17:56
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ |  Problem System Error. Updates funktionieren nicht Ok soweit. Das silentrunners Log könntest Du hier als Anhang posten oder alternativ bei file-upload.net hochladen und hier verlinken. Poste bitte auch noch neues HijackThis logfile aber diesmal regelkonform!!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
15.06.2008, 22:53
| #10 |
| | Problem System Error. Updates funktionieren nicht TEIL 2 Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Dokumente und Einstellungen\OpTiKinG\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ BridgeCS3ImportMediaOnArrival\ "Provider" = "Adobe Bridge CS3" "InvokeProgID" = "Adobe.adobebridge" "InvokeVerb" = "launch" HKLM\SOFTWARE\Classes\Adobe.adobebridge\shell\launch\command\(Default) = "C:\Programme\Adobe\Adobe Bridge CS3\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."] dMCAudioCDInput\ "Provider" = "dMC Audio CD Input" "InvokeProgID" = "dMC.AudioCD.Autorun" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\dMC.AudioCD.Autorun\shell\open\command\(Default) = ""C:\Programme\Illustrate\dBpowerAMP\CDGrab.exe"" ["Illustrate"] DVDneXtCOPYPlayDVDMovieOnArrival\ "Provider" = "DVDneXtCOPY" "InvokeProgID" = "DVDneXtCOPY" "InvokeVerb" = "PlayDVDMovieOnArrival_DVDneXtCOPY" HKLM\SOFTWARE\Classes\DVDneXtCOPY\shell\PlayDVDMovieOnArrival_DVDneXtCOPY\Command\(Default) = ""C:\Programme\DVDneXtCOPY2\DVDneXtCOPY2.exe" /WORK /NEW /SOURCE="%1"" [file not found] IviDVDEventHandler\ "Provider" = "InterVideo WinDVD" "InvokeProgID" = "Ivi.MediaFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\WinDVD\WinDVD.exe %1" ["InterVideo Inc."] IviVideoCDHandler\ "Provider" = "InterVideo WinDVD" "InvokeProgID" = "Ivi.MediaFile" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\Ivi.MediaFile\shell\play\command\(Default) = "C:\Programme\InterVideo\WinDVD\WinDVD.exe %1" ["InterVideo Inc."] MSPictureIt10ViewOnArrival\ "Provider" = "Microsoft Foto Designer-Bibliothek - Import-Assistent" "InvokeProgID" = "Microsoft.Picture.It.10.AutoPlay" "InvokeVerb" = "AutoPlay" HKLM\SOFTWARE\Classes\Microsoft.Picture.It.10.AutoPlay\shell\AutoPlay\Command\(Default) = "C:\Programme\Picture It! Premium 10\imprtwiz.exe /invoke={D0551EC1-5A78-11cf-9DBE-00AA00A70BB5}" [MS] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] MXCDRBurningCDArrival\ "Provider" = "MAGIX Goya" "InvokeProgID" = "Magix.MXCDR" "InvokeVerb" = "Show" HKLM\SOFTWARE\Classes\Magix.MXCDR\shell\Show\DropTarget\CLSID = "{FF482932-87EF-409E-9C02-48E9FF861CBF}" -> {HKLM...CLSID} = "MXCDR AutoplayClass" \LocalServer32\(Default) = "C:\Programme\MAGIX\Goya_burnR_mxcdr\Goya.exe" ["MAGIX AG"] MXFotomakerBrowseOnArrival\ "Provider" = "MAGIX Digital Foto Maker 2007" "InvokeProgID" = "Magix.Fotomaker" "InvokeVerb" = "Brws" HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Brws\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}" -> {HKLM...CLSID} = "MXFotomaker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"] MXFotomakerBurningCDArrival\ "Provider" = "MAGIX Digital Foto Maker 2007" "InvokeProgID" = "Magix.Fotomaker" "InvokeVerb" = "Burn" HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\Burn\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}" -> {HKLM...CLSID} = "MXFotomaker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"] MXFotomakerPlayAudioOnArrival\ "Provider" = "MAGIX Digital Foto Maker 2007" "InvokeProgID" = "Magix.Fotomaker" "InvokeVerb" = "PlayA" HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayA\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}" -> {HKLM...CLSID} = "MXFotomaker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"] MXFotomakerPlayCDOnArrival\ "Provider" = "MAGIX Digital Foto Maker 2007" "InvokeProgID" = "Magix.Fotomaker" "InvokeVerb" = "PlayCD" HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\PlayCD\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}" -> {HKLM...CLSID} = "MXFotomaker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"] MXFotomakerShowPicturesOnArrival\ "Provider" = "MAGIX Digital Foto Maker 2007" "InvokeProgID" = "Magix.Fotomaker" "InvokeVerb" = "ShwPic" HKLM\SOFTWARE\Classes\Magix.Fotomaker\shell\ShwPic\DropTarget\CLSID = "{51BD566E-A02D-4387-9A82-D929EA8C20B0}" -> {HKLM...CLSID} = "MXFotomaker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Foto_Manager_2007\FotoMaker.exe" ["MAGIX"] MXMP3MakerBrowseOnArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "Brws" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Brws\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXMP3MakerBurningCDArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "Burn" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\Burn\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXMP3MakerPlayAudioOnArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "PlayA" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayA\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXMP3MakerPlayCDOnArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "PlayCD" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayCD\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXMP3MakerPlayVideoOnArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "PlayV" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\PlayV\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXMP3MakerShowPicturesOnArrival\ "Provider" = "MAGIX MP3 Maker 12" "InvokeProgID" = "Magix.MP3Maker" "InvokeVerb" = "ShwPic" HKLM\SOFTWARE\Classes\Magix.MP3Maker\shell\ShwPic\DropTarget\CLSID = "{C783A282-958A-4684-9093-AB409B3834E0}" -> {HKLM...CLSID} = "MXMP3Maker Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Music_Manager_2007\MP3Maker.exe" ["MAGIX"] MXSuiteBurningCDArrival\ "Provider" = "MAGIX Goya burnR" "InvokeProgID" = "Magix.MXSuite" "InvokeVerb" = "Show" HKLM\SOFTWARE\Classes\Magix.MXSuite\shell\Show\DropTarget\CLSID = "{F9AD4E4F-B992-4B84-AC51-9F990D5F4738}" -> {HKLM...CLSID} = "MAGIXSuite Autoplay Class" \LocalServer32\(Default) = "C:\Programme\MAGIX\Goya_burnR\Goya.exe" ["MAGIX AG"] MxVideoDeLuxeBurningCDArrival\ "Provider" = "MAGIX Video deLuxe 2005/2006 PLUS" "InvokeProgID" = "Magix.videodeLuxe" "InvokeVerb" = "Show" HKLM\SOFTWARE\Classes\Magix.videodeLuxe\shell\Show\DropTarget\CLSID = "{1810360D-0FC7-474B-ABC1-84E96BF51D2F}" -> {HKLM...CLSID} = "videodeLuxe AutoplayClass" \LocalServer32\(Default) = "K:\ProgramZ 'n GameZ\VideoDeluxe\videodeLuxe.exe" [file not found] MxVideoDeLuxeVideoCameraArrival\ "Provider" = "MAGIX Video deLuxe 2005/2006 PLUS" "ProgID" = "Magix.videodeLuxe" HKLM\SOFTWARE\Classes\Magix.videodeLuxe\CLSID\(Default) = "{1810360D-0FC7-474B-ABC1-84E96BF51D2F}" -> {HKLM...CLSID} = "videodeLuxe AutoplayClass" \LocalServer32\(Default) = "K:\ProgramZ 'n GameZ\VideoDeluxe\videodeLuxe.exe" [file not found] NeroAutoPlay8AudioToNeroDigital\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"] NeroAutoPlay8CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CDAudio_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:AudioCD" ["Nero AG"] NeroAutoPlay8CopyCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog iscCopy %L" ["Nero AG"]NeroAutoPlay8DataDisc_CD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "DataDisc_CD_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_CD_HandleCDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /Media:CD %L" ["Nero AG"] NeroAutoPlay8DataDisc_DVD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "DataDisc_DVD_HandleDVDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_DVD_HandleDVDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe -w /New:ISODisc /Media VD %L" ["Nero AG"]NeroAutoPlay8LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "LaunchNeroStartSmart_HandleDVDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\LaunchNeroStartSmart_HandleDVDBurningOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"] NeroAutoPlay8PlayAudioCD\ "Provider" = "Nero ShowTime" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "PlayAudioCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayAudioCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"] NeroAutoPlay8PlayDVD\ "Provider" = "Nero ShowTime" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "PlayDVD_PlayVideoFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayDVD_PlayVideoFilesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"] NeroAutoPlay8RipCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "RipCD_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Burning Rom\nero.exe /Dialog:SaveTracks %L" ["Nero AG"] NeroAutoPlay8TranscodeVideo\ "Provider" = "Nero Recode" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "TranscodeVideo_PlayDVDMovieOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\TranscodeVideo_PlayDVDMovieOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero Recode\Recode.exe /New:CopyDVDVideo" ["Nero AG"] NeroAutoPlay8VideoCapture\ "Provider" = "Nero Vision" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Programme\Nero\Nero8\Nero Vision\NeroVision.exe" /New:VideoCapture" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] NeroAutoPlay8ViewPhotos\ "Provider" = "Nero PhotoSnap Viewer" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "ViewPhotos_ShowPicturesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\ViewPhotos_ShowPicturesOnArrival\command\(Default) = "C:\Programme\Nero\Nero8\Nero PhotoSnap\PhotoSnapViewer.exe /" ["Nero AG"] PCLEVideoCameraArrival\ "Provider" = "Pinnacle Studio" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Programme\Pinnacle\Studio 9\programs\studio.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] RPCDBurningOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.CDBurn.6" "InvokeVerb" = "open" HKCU\Software\Classes\RealPlayer.CDBurn.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /burn "%1"" ["RealNetworks, Inc."] RPDeviceOnArrival\ "Provider" = "RealPlayer" "ProgID" = "RealPlayer.HWEventHandler" HKLM\SOFTWARE\Classes\RealPlayer.HWEventHandler\CLSID\(Default) = "{67E76F1D-BDE2-4052-913C-2752366192D2}" -> {HKLM...CLSID} = "RealNetworks Scheduler" \LocalServer32\(Default) = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -autoplay" ["RealNetworks, Inc."] RPPlayCDAudioOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.AudioCD.6" "InvokeVerb" = "play" HKCU\Software\Classes\RealPlayer.AudioCD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /play %1 " ["RealNetworks, Inc."] RPPlayDVDMovieOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.DVD.6" "InvokeVerb" = "play" HKCU\Software\Classes\RealPlayer.DVD.6\shell\play\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /dvd %1 " ["RealNetworks, Inc."] RPPlayMediaOnArrival\ "Provider" = "RealPlayer" "InvokeProgID" = "RealPlayer.AutoPlay.6" "InvokeVerb" = "open" HKCU\Software\Classes\RealPlayer.AutoPlay.6\shell\open\command\(Default) = ""C:\Program Files\Real\RealPlayer\RealPlay.exe" /autoplay "%1"" ["RealNetworks, Inc."] VLCPlayCDAudioOnArrival\ "Provider" = "VideoLAN VLC media player" "InvokeProgID" = "VLC.CDAudio" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\VLC.CDAudio\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file cdda:%1" ["VideoLAN Team"] VLCPlayDVDMovieOnArrival\ "Provider" = "VideoLAN VLC media player" "InvokeProgID" = "VLC.DVDMovie" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\VLC.DVDMovie\shell\play\command\(Default) = "C:\Programme\VideoLAN\VLC\vlc.exe --started-from-file dvd:%1" ["VideoLAN Team"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Programme\Winamp1\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] Startup items in "OpTiKinG" & "All Users" startup folders: ---------------------------------------------------------- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Enabled Scheduled Tasks: ------------------------ "AED15AE891CECD54" -> launches: "c:\dokume~1\optiking\anwend~1\onceai~1\bits close web.exe" [file not found] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS] 000000000002\LibraryPath = "C:\WINDOWS\system32\pnrpnsp.dll" [MS] 000000000003\LibraryPath = "C:\Programme\Bonjour\mdnsNSP.dll" ["Apple Computer, Inc."] 000000000004\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000005\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000006\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 38 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{855F3B16-6D32-4FE6-8A56-BBB695989046}" -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_05" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_05" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_05\bin\npjpi160_05.dll" ["Sun Microsystems, Inc."] {94EDF7B4-4272-4AF3-8F8B-4E2F68E225B7}\ "ButtonText" = "PacificPoker4" "Exec" = "C:\PROGRA~1\PACIFI~1\pacificpoker.exe" ["Cassava Ent."] {B205A35E-1FC4-4CE3-818B-899DBBB3388C}\ {B863453A-26C3-4E1F-A54D-A2CD196348E9}\ "ButtonText" = "ICQ Lite" "MenuText" = "ICQ Lite" "Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."] {F4430FE8-2638-42E5-B849-800749B94EED}\ "ButtonText" = "PartyPoker.net" "MenuText" = "PartyPoker.net" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{855F3B16-6D32-4fe6-8A56-BBB695989046}" = (no title provided) -> {HKLM...CLSID} = "ICQ Toolbar" \InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["IE Toolbar"] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["Avira GmbH"] AntiVir PersonalEdition Classic Planer, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"] Ashampoo AntiSpyWare 2 Service, AASW2_Service, "C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe" [null data] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Einfache TCP/IP-Dienste, SimpTcp, "C:\WINDOWS\system32\tcpsvcs.exe" [MS] IPv6-Hilfsdienst, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]} Nero BackItUp Scheduler 3, Nero BackItUp Scheduler 3, "C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe" ["Nero AG"] T-Online WLAN Adapter Steuerungsdienst, MZCCntrl, "C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe" ["T-Online International AG, Marmiko IT-Solutions GmbH"] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ LPR Port\Driver = "lprmon.dll" [MS] Microsoft Shared Fax Monitor\Driver = "FXSMON.DLL" [MS] |
|
15.06.2008, 22:56
| #11 |
| | Problem System Error. Updates funktionieren nicht Und hier noch Hijack Log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:49:06, on 15.06.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Programme\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe C:\WINDOWS\NCLAUNCH.EXe C:\WINDOWS\System32\svchost.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\Messenger\msmsgs.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Nachrichten - Service - Shopping bei t-online.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: (no name) - {f83c6003-6fe1-4814-9b52-272bd8a64c77} - (no file) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [\\WOHNZIMMER\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P39 "\\WOHNZIMMER\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600" O4 - HKLM\..\Run: [Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P53 "Automatisch EPSON Stylus CX3600 Series auf WOHNZIMMER" /O21 "\\WOHNZIMMER\Drucker3" /M "Stylus CX3600" O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg O4 - HKLM\..\Run: [Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P56 "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER" /O42 "\\LT-WOHNZIMMER\EPSON Stylus CX3600 Series" /M "Stylus CX3600" O4 - HKLM\..\Run: [\\lt-wohnzimmer\EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P42 "\\lt-wohnzimmer\EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AntiSpyWare2Guard] C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe O4 - HKCU\..\Run: [Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P56 "Automatisch EPSON Stylus CX3600 Series auf LT-WOHNZIMMER" /M "Stylus CX3600" /EF "HKCU" O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Add to Windows &Live Favorites - Add to Windows Live Favorites O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://**p://w*w.powerchallenge.com/...owerLoader.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://**p://update.microsoft.com/wi...?1213477884859 O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Programme\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: UPnPService - Magix AG - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe -- End of file - 9004 bytes DAS PROBLEM DAS DIE WINDOWS UPDATES NICHT INSTALLIERT WERDEN KÖNNEN BESTEHT WEITERHIN!!!!!!!!!!!!! Geändert von jinchiller (15.06.2008 um 23:02 Uhr) |
|
15.06.2008, 23:08
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Problem System Error. Updates funktionieren nichtZitat:
 Es hat niemals jmd gesagt daß nach erfolgter sogenannter Bereinigung Dein System nun wieder so zuverlässig arbeitet wie ein frisch aufgesetztes. Jede Installation und Deinstallation läßt das System altern - irgendwann ist soviel rauf und runterinstalliert worden, daß nur noch formatieren und neu installieren hilft. Ich habe den Eindruck bei Deinem PC ist es soweit aus ihm wieder ne Jungfrau zu machen  Hat auch den Vorteil, daß man Altlasten endlich loswird. Jungfrau eben.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Problem System Error. Updates funktionieren nicht |
| attention, detected, download, error, fehlermeldung, files, firefox, folge, funktionieren, funktionieren nicht, google, hijacklog, hijackthis, internet, klicke, links, nicht mehr, problem, software, system, this, trend, trojan, updates, windows, windows updates, windows xp |
Linear-Darstellung
