| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/BHO.Gen und andere echt ätzende DingeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
03.07.2008, 01:37
| #1 |
 |  TR/BHO.Gen und andere echt ätzende Dinge Hallo Ihr Lieben, ich habe da ein Problem oder eigentlich gleich mehrere.. 1. Obiger Trojaner wurde soeben von Avira entdeckt. 2. Ich habe einen LG E 500 Laptop, der hat oben rechts so shortcuttasten, u.a. auch eine fürs mailprogramm. Witzigerweise muss ich diese Taste gar nicht bedienen damit mir das neue outlook bzw neuerdings der thunderbird hallo sagt. Das schafft das program ganz von alleine und zwar zwischendurch immer mal wieder so 20 mal die minute. Das macht mich wahnsinnig. 3. Seit 3 Tagen ca schmiert mir ständig der Rechner ab, egal ob ich grad WOW zocke oder einen film gucke oder einfach nur auf den Desktop starre. so und nun wäre ich sehr erfreut wenn sich irgendwer berufen fühlt mir aus dieser misere zu helfen. Aber bitte für ganz doofe denn ich bin eine Frau! Herzlichen Dank!
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 01:51
| #2 | |
| > MalwareDB   | TR/BHO.Gen und andere echt ätzende DingeZitat:
 Poste doch für den Anfang mal ein HijackThis Logfile.
__________________ |
|
03.07.2008, 02:01
| #3 |
| | TR/BHO.Gen und andere echt ätzende Dinge also damit kann ich umgehen
__________________ dafür bin ich eher kreativ und rhetorisch orientiert, nur soviele fakten ich auch auf den tisch knalle, die antwort meines laptop lautet doch immer : "wayne..." Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:54:26, on 03.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16609) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\eMule\emule.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Nero\Nero8\Nero ShowTime\ShowTime.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Windows\system32\DivXsm.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = wayne.go.microsoft.  /fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wayne.google. /R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = wayne.lge. R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = wayne.go.microsoft. /fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = wayne.go.microsoft. /fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = wayne.go.microsoft. /fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ? O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Evil Driver Daemon (NishService) - Unknown owner - C:\Program Files\LG Software\System Control Manager\edd.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 8370 bytes et voila!
__________________ |
|
03.07.2008, 02:15
| #4 |
| > MalwareDB | TR/BHO.Gen und andere echt ätzende Dinge Das Logfile ist sauber, wo findet Avira denn die Infektionen?
__________________ If every computer is running a diverse ecosystem, crackers will have no choice but to resort to small-scale, targetted attacks, and the days of mass-market malware will be over[...]. Stuart Udall |
|
03.07.2008, 02:18
| #5 |
| | TR/BHO.Gen und andere echt ätzende Dinge na da fragst du mich was.. das war irgendwas mit C: und windows und system 32... und was is mit dem rest? kann ich irgendwie den rechner dazu bringen das mailprogramm nie wieder aufzurufen? ich brauch nämlich weder das eine noch das andere...
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 02:26
| #6 |
| > MalwareDB | TR/BHO.Gen und andere echt ätzende Dinge Sauber bedeutet für mich, dass ich keine besonderen Einträge finde. Du verwendest eMule, dies Progrmm ist nicht grade ein Heilsbringer.  Lass uns noch weiter schauen. Deckards System Scanner (DSS) Hier gibt es das Tool -> dss.exe * Schließe alle Anwendungen * Doppelklicke dss.exe um das Programm zu starten * Wenn der Scan abgeschlossen ist wird sich ein Notepad mit dem Inhalt der main.txt öffnen. Ein weiteres Logfile, die extra.txt liegt im Verzeichnis c:\Deckard\SystemScanner\extra.txt * Kopiere den Inhalt der beiden Logfiles in diesen Thread, bitte als [CODE][/CODE] Was Deckards System Scanner macht: * Es Erstellt einen System Wiederherstellungspunkt * es säubert die temporären Dateien, Downloaded Program Files, Internet Cache Dateien und es leert den Mülleimer auf allen Laufwerken.
__________________ --> TR/BHO.Gen und andere echt ätzende Dinge |
|
03.07.2008, 02:40
| #7 |
| | TR/BHO.Gen und andere echt ätzende DingeCode:
ATTFilter Deckard's System Scanner v20071014.68 Run by KIEZMIEZ on 2008-07-03 03:34:33 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 7: 2008-07-02 04:27:58 UTC - RP191 - Geplanter Prüfpunkt 6: 2008-07-01 04:29:15 UTC - RP190 - Geplanter Prüfpunkt 5: 2008-06-29 16:37:39 UTC - RP189 - Geplanter Prüfpunkt 4: 2008-06-28 20:39:01 UTC - RP188 - Geplanter Prüfpunkt 3: 2008-06-28 01:20:32 UTC - RP187 - Geplanter Prüfpunkt -- First Restore Point -- 1: 2008-06-20 22:00:01 UTC - RP185 - Geplanter Prüfpunkt Backed up registry hives. Performed disk cleanup. System Drive C: has 4.74 GiB (less than 15%) free. -- HijackThis (run as KIEZMIEZ.exe) -------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 03:35:52, on 03.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16609) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe C:\Users\KIEZMIEZ\Desktop\dss.exe C:\Windows\system32\conime.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\KIEZMIEZ.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.lge.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ? O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Evil Driver Daemon (NishService) - Unknown owner - C:\Program Files\LG Software\System Control Manager\edd.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- End of file - 8159 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R2 CDRPDACC (Quinnware CDDA Driver (by InfinaDyne)) - \??\c:\program files\quintessential player\cdrpdacc.sys R3 MGHwCtrl - \??\c:\windows\system32\drivers\mghwctrl.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AntiVirScheduler (Avira AntiVir Personal – Free Antivirus Scheduler) - "c:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation> R2 Bonjour Service (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Computer, Inc.; Bonjour> R2 Nero BackItUp Scheduler 3 - c:\program files\nero\nero8\nero backitup\nbservice.exe R2 NishService (Evil Driver Daemon) - c:\program files\lg software\system control manager\edd.exe R2 o2flash (O2Micro Flash Memory Card Service) - "c:\program files\o2micro oz128 driver\o2flash.exe" <Not Verified; O2Micro International; O2 MS1/MP1 Service> R3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Files created between 2008-06-03 and 2008-07-03 ----------------------------- 2008-07-03 02:53:22 0 d-------- C:\Program Files\Trend Micro 2008-06-09 21:50:39 0 d-------- C:\Users\All Users\InstallShield 2008-06-09 21:49:54 0 d-------- C:\Windows\system32\AGEIA 2008-06-09 21:49:53 0 d-------- C:\Program Files\AGEIA Technologies 2008-06-09 21:49:40 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-06-09 21:46:32 0 d-------- C:\Program Files\Focus 2008-06-09 21:00:29 0 d-------- C:\Program Files\ANACONDA 2008-06-05 14:29:05 0 d-------- C:\Program Files\Im Schatten der Mumie 2008-06-05 14:25:53 268048 --a------ C:\Windows\system32\dxtmeta2.dll <Not Verified; MetaCreations Corporation; DirectTransform> -- Find3M Report --------------------------------------------------------------- 2008-07-02 00:37:06 641344 --a------ C:\Windows\system32\perfh007.dat 2008-07-02 00:37:06 116706 --a------ C:\Windows\system32\perfc007.dat 2008-07-01 20:42:39 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Adobe 2008-06-27 00:29:54 12 --a------ C:\Windows\bthservsdp.dat 2008-06-16 20:43:44 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Skype 2008-06-16 20:36:44 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\skypePM 2008-06-10 09:49:59 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-10 09:49:45 0 d-------- C:\Program Files\ICQ Spiele 2008-06-10 09:48:28 0 d-------- C:\Program Files\LG Software 2008-06-09 21:51:24 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Games 2008-06-09 21:49:40 0 d-------- C:\Program Files\Common Files 2008-06-09 21:46:30 0 d-------- C:\Program Files\Common Files\InstallShield 2008-06-06 03:50:39 0 d-------- C:\Program Files\Common Files\Oberon Media 2008-05-29 14:51:31 0 d-------- C:\Program Files\EA GAMES 2008-05-27 17:39:53 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\DivX 2008-05-27 07:58:37 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Talkback 2008-05-27 07:58:32 0 --a------ C:\Windows\nsreg.dat 2008-05-27 07:58:32 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Mozilla 2008-05-27 07:58:31 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Thunderbird 2008-05-27 07:58:22 0 d-------- C:\Program Files\Mozilla Thunderbird 2008-05-22 20:16:07 56 --ah----- C:\Windows\system32\ezsidmv.dat 2008-05-22 17:05:54 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-05-21 14:09:03 0 d-------- C:\Program Files\DAEMON Tools 2008-05-20 13:04:05 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Meridian93 2008-05-20 11:52:51 0 d-------- C:\Program Files\ProtectDisc Driver Installer 2008-05-20 01:56:34 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Real 2008-05-19 15:09:25 0 d-------- C:\Program Files\ReflexiveArcade 2008-05-18 12:17:44 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\WinRAR 2008-05-17 22:17:28 0 d-------- C:\Program Files\World of Warcraft 2008-05-17 22:10:07 0 d-------- C:\Program Files\lg_swupdate 2008-05-17 22:01:30 0 d-------- C:\Program Files\eMule 2008-05-17 21:59:54 0 d-------- C:\Program Files\Quintessential Player 2008-05-17 21:58:41 0 d-------- C:\Program Files\Codec Pack - All In 1 2008-05-17 21:57:09 0 d-------- C:\Program Files\Avira 2008-05-17 21:56:40 737280 --a------ C:\Windows\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module> 2008-05-17 21:55:24 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\DAEMON Tools 2008-05-17 21:54:21 0 d-------- C:\Program Files\Skype 2008-05-17 21:54:20 0 d-------- C:\Program Files\Common Files\Skype 2008-05-17 21:50:24 0 d-------- C:\Program Files\Common Files\xing shared 2008-05-17 21:50:23 0 d-------- C:\Program Files\Common Files\Real 2008-05-17 21:50:17 0 d-------- C:\Program Files\Real 2008-05-17 21:49:05 0 d-------- C:\Program Files\QuickTime 2008-05-17 21:48:26 0 d-------- C:\Program Files\Apple Software Update 2008-05-17 21:47:51 0 d-------- C:\Program Files\K-Lite Codec Pack 2008-05-17 21:44:44 0 d-------- C:\Program Files\DivX 2008-05-17 21:44:42 0 d-------- C:\Program Files\Common Files\PX Storage Engine 2008-05-17 21:43:56 0 d-------- C:\Program Files\Java 2008-05-17 21:43:20 0 d-------- C:\Program Files\Common Files\Java 2008-05-17 21:42:50 0 d-------- C:\Program Files\CCleaner 2008-05-17 21:40:49 0 d-------- C:\Program Files\ICQ6 2008-05-17 21:40:47 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\ICQ 2008-05-17 21:30:07 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Nero 2008-05-17 21:29:08 0 d-------- C:\Program Files\Common Files\Nero 2008-05-17 21:26:16 0 d-------- C:\Program Files\Nero 2008-05-17 21:19:40 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Macromedia 2008-05-17 18:27:48 0 d-------- C:\Program Files\Bonjour 2008-05-17 18:24:56 0 d-------- C:\Program Files\Common Files\Macrovision Shared 2008-05-17 18:21:12 0 d-------- C:\Program Files\Common Files\Protexis 2008-05-17 18:19:19 0 d-------- C:\Program Files\Common Files\Corel 2008-05-17 18:18:33 0 d-------- C:\Program Files\Corel 2008-05-17 18:09:07 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\InstallShield 2008-05-17 17:42:16 0 d-------- C:\Program Files\Common Files\Adobe 2008-05-17 17:40:45 0 d-------- C:\Program Files\Common Files\Control Panels 2008-05-17 17:35:45 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\ATI 2008-05-17 17:35:27 0 d-------- C:\Users\KIEZMIEZ\AppData\Roaming\Identities 2008-05-17 17:28:21 0 d-------- C:\Program Files\Windows NT 2008-05-17 17:28:21 0 d--hs---- C:\Program Files\Gemeinsame Dateien 2008-05-13 03:53:16 3596288 --a------ C:\Windows\system32\qt-dx331.dll 2008-05-13 03:50:16 196608 --a------ C:\Windows\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-05-13 03:50:16 81920 --a------ C:\Windows\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-05-13 03:50:08 802816 --a------ C:\Windows\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-05-13 03:50:08 823296 --a------ C:\Windows\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 03:50:08 831488 --a------ C:\Windows\system32\divx_xx0a.dll 2008-05-13 03:50:08 823296 --a------ C:\Windows\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 03:50:06 682496 --a------ C:\Windows\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 03:49:02 12288 --a------ C:\Windows\system32\DivXWMPExtType.dll -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MGSysCtrl"="C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe" [21.11.2007 14:33] "RtHDVCpl"="RtHDVCpl.exe" [17.12.2007 12:02 C:\Windows\RtHDVCpl.exe] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [21.01.2008 13:17] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [22.11.2006 22:20] "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [22.10.2006 23:24] "@"="" [] "Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [20.03.2007 16:40] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25.03.2008 04:28] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [12.02.2008 10:06] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [17.05.2008 21:50] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [16.08.2007 13:24] "eMuleAutoStart"="C:\Program Files\eMule\emule.exe" [11.05.2008 13:19] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Acrobat - Schnellstart.lnk - C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [17.05.2008 18:34:41] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [23.10.2006 00:01:50] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13.02.2001 00:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableLUA"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum bthsvcs BthServ [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-07-03 03:36:38 ------------
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 02:43
| #8 |
| | TR/BHO.Gen und andere echt ätzende Dinge extra.txt Code:
ATTFilter Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------
-- System Information ----------------------------------------------------------
Microsoft® Windows Vista™ Home Premium (build 6000)
Architecture: X86; Language: German
CPU 0: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 2046.75 MiB / 1180.04 MiB
Pagefile Memory (total/avail): 4328.52 MiB / 3192.49 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1899.18 MiB
C: is Fixed (NTFS) - 50 GiB total, 4.74 GiB free.
D: is Fixed (NTFS) - 181.88 GiB total, 47.59 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)
\\.\PHYSICALDRIVE0 - Hitachi HTS542525K9A300 ATA Device - 232.89 GiB - 3 partitions
\PARTITION0 - Unknown - 1024 MiB
\PARTITION1 (bootable) - Installierbares Dateisystem - 50 GiB - C:
\PARTITION2 - Installierbares Dateisystem - 181.88 GiB - D:
-- Security Center -------------------------------------------------------------
AUOptions is set to notify before download.
Windows Internal Firewall is enabled.
AV: Avira AntiVir PersonalEdition v8.0.1.18 (Avira GmbH)
AS: Windows-Defender v1.1.1505.0 (Microsoft Corporation) Outdated
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
-- Environment Variables -------------------------------------------------------
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\KIEZMIEZ\AppData\Roaming
CLASSPATH=.;C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=KIEZMIEZ-PC
ComSpec=C:\Windows\system32\cmd.exe
configsetroot=C:\Windows\ConfigSetRoot
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\KIEZMIEZ
LOCALAPPDATA=C:\Users\KIEZMIEZ\AppData\Local
LOGONSERVER=\\KIEZMIEZ-PC
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Program Files\Mozilla Firefox;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\Nero\Lib\;C:\Program Files\Common Files\Nero\Lib\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 23 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=1706
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
QTJAVA=C:\Program Files\Java\jre1.6.0_06\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\KIEZMIEZ\AppData\Local\Temp
TMP=C:\Users\KIEZMIEZ\AppData\Local\Temp
USERDOMAIN=KIEZMIEZ-PC
USERNAME=KIEZMIEZ
USERPROFILE=C:\Users\KIEZMIEZ
windir=C:\Windows
-- User Profiles ---------------------------------------------------------------
KIEZMIEZ (admin)
-- Add/Remove Programs ---------------------------------------------------------
--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
--> C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\Windows\UNNeroBackItUp.exe /UNINSTALL
--> C:\Windows\UNNeroMediaHome.exe /UNINSTALL
--> C:\Windows\UNNeroShowTime.exe /UNINSTALL
--> C:\Windows\UNNeroVision.exe /UNINSTALL
--> C:\Windows\UNRecode.exe /UNINSTALL
--> MsiExec /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe BridgeTalk Plugin CS3 --> MsiExec.exe /I{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}
Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings --> MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings --> MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Creative Suite 3 Design Premium --> MsiExec.exe /I{4393DE35-AD67-4F37-95E4-30F06EA0FDB2}
Adobe Creative Suite 3 Design Premium hinzufügen oder entfernen --> C:\Program Files\Common Files\Adobe\Installers\061850775b1c6d22bf2a145678e05e0\Setup.exe
Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Dreamweaver CS3 --> MsiExec.exe /I{4AA5B8A5-BEEF-4AD8-B11D-4443A042EA4F}
Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Extension Manager CS3 --> MsiExec.exe /I{BE5F3842-8309-4754-92D5-83E02E6077A3}
Adobe Flash CS3 --> MsiExec.exe /I{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}
Adobe Flash Player 9 Plugin --> MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Video Encoder --> MsiExec.exe /I{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}
Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3 --> MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Illustrator CS3 --> MsiExec.exe /I{C8D7A672-F697-4572-AC62-C856053A8DBC}
Adobe InDesign CS3 --> MsiExec.exe /I{411E0CC3-587A-468C-B461-95FAFD05E4DE}
Adobe InDesign CS3 Icon Handler --> MsiExec.exe /I{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}
Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe MotionPicture Color Files --> MsiExec.exe /I{6B708481-748A-4EB4-97C1-CD386244FF77}
Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3 --> MsiExec.exe /I{D3C605D8-3A5E-4BAD-965D-2C61441BF2AC}
Adobe Setup --> MsiExec.exe /I{5518E08A-2053-4A3E-85B2-F912D4666C9F}
Adobe SING CS3 --> MsiExec.exe /I{B671CBFD-4109-4D35-9252-3062D3CCB7B2}
Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe Version Cue CS3 Server --> MsiExec.exe /I{1D58229F-C505-45CA-8223-F35F3A34B963}
Adobe WAS CS3 --> MsiExec.exe /I{C5BD220A-EFE8-48A5-B70E-9503D535FACE}
Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
AGEIA PhysX v7.09.13 --> MsiExec.exe /X{45235788-142C-44BE-8A4D-DDE9A84492E5}
Agere Systems HDA Modem --> agrsmdel
AHV content for Acrobat and Flash --> MsiExec.exe /I{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
Atheros Driver Installation Program --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{28006915-2739-4EBE-B5E8-49B25D32EB33}\setup.exe" -l0x7 -removeonly
Avira AntiVir Personal – Free Antivirus --> C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Catalyst Control Center - Branding --> MsiExec.exe /I{3F3328F3-79EE-4B2C-A5E2-13D5787ADAC1}
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Codec Pack - All In 1 6.0.3.0 --> C:\Windows\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
CorelDRAW Graphics Suite X4 --> MsiExec.exe /I{44A27085-0616-4181-A0C3-81C7ECA17F73}
CorelDRAW Graphics Suite X4 - Capture --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF012}
CorelDRAW Graphics Suite X4 - Content --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF016}
CorelDRAW Graphics Suite X4 - Draw --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF013}
CorelDRAW Graphics Suite X4 - Filters --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF017}
CorelDRAW Graphics Suite X4 - FontNav --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF019}
CorelDRAW Graphics SUite X4 - ICA --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF010}
CorelDRAW Graphics Suite X4 - IPM --> MsiExec.exe /I{9D0798D0-AF6C-4E62-94B1-AEBF1A43E00A}
CorelDRAW Graphics Suite X4 - Lang DE --> MsiExec.exe /I{AEFBAC58-2DDD-4CEF-BDFD-52A5A5F432ED}
CorelDRAW Graphics Suite X4 - PP --> MsiExec.exe /I{7F05E704-30A6-421A-97A7-8EEB1C7FF014}
CorelDRAW Graphics Suite X4 - VBA --> MsiExec.exe /I{BF439B41-0252-48DE-8B8B-0430CB26A181}
CorelDRAW(R) Graphics Suite X4 --> c:\Program Files\Corel\CorelDRAW Graphics Suite X4\Setup\SetupARP.exe /arp
CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension --> c:\Program Files\Common Files\Corel\Shared\Shell Extension\Uninst.exe
CorelDRAW(R) Graphics Suite X4 - Windows Shell Extension --> MsiExec.exe /X{CE2DA11A-917F-4CF5-AB55-755EC115DD10}
Die Sims 2 --> C:\Program Files\EA GAMES\Die Sims 2\EAUninstall.exe
Die Sims 2: Family Fun - Accessoires --> C:\Program Files\EA GAMES\Die Sims 2 Family Fun - Accessoires\EAUninstall.exe
Die Sims 2: Nightlife --> C:\Program Files\EA GAMES\Die Sims 2 Nightlife\EAUninstall.exe
Die Sims 2: Open For Business --> C:\Program Files\EA GAMES\Die Sims 2 Open For Business\EAUninstall.exe
Die Sims 2: Wilde Campus-Jahre --> C:\Program Files\EA GAMES\Die Sims 2 Wilde Campus-Jahre\EAUninstall.exe
Die Sims™ 2 H&M®-Fashion-Accessoires --> C:\Program Files\EA GAMES\Die Sims 2 H&M®-Fashion-Accessoires\EAUninstall.exe
Die Sims™ 2 Haustiere --> C:\Program Files\EA GAMES\Die Sims 2 Haustiere\EAUninstall.exe
Die Sims™ 2 Party-Accessoires --> C:\Program Files\EA GAMES\Die Sims 2 Party-Accessoires\EAUninstall.exe
Die Sims™ 2 Vier Jahreszeiten --> C:\Program Files\EA GAMES\Die Sims 2 Vier Jahreszeiten\EAUninstall.exe
Die Sims™ 2: Glamour-Accessoires --> C:\Program Files\EA GAMES\Die Sims 2 Glamour-Accessoires\EAUninstall.exe
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Dracula Origin --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35A0C956-ACF1-41AB-89DE-1772C8A27ACB}\setup.exe" -l0x7 -removeonly
eMule --> "C:\Program Files\eMule\Uninstall.exe"
GUILD WARS --> "D:\Games\GUILD WARS\Gw.exe" -uninstall
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
ICQ6 --> C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe -runfromtemp -l0x0009 -removeonly
Java(TM) 6 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
K-Lite Codec Pack 3.9.0 Full --> "C:\Program Files\K-Lite Codec Pack\unins000.exe"
LG Intelligent Update --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{81717D01-32F6-449C-85E1-41AFD678E545}\SETUP.EXE"
Microsoft Office XP Professional mit FrontPage --> MsiExec.exe /I{90280407-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.14) --> C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
Nero 8 --> MsiExec.exe /X{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1031}
O2Micro Flash Memory Card Reader Driver Installer(x86) --> MsiExec.exe /X{78764173-3805-4916-B3CE-B433702B8870}
PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
ProtectDisc Driver, Version 11 --> C:\Program Files\ProtectDisc Driver Installer\uninstall_v11.exe
QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}
Quintessential Player --> "C:\Program Files\Quintessential Player\uninst.exe"
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista --> C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver --> RtlUpd.exe -r -m
Skype™ 3.8 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Control Manager --> C:\Program Files\InstallShield Installation Information\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}\setup.exe -runfromtemp -l0x0009 -removeonly
THE SETTLERS - Rise of an Empire --> "C:\Program Files\InstallShield Installation Information\{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}\setup.exe" -runfromtemp -l0x0009 -removeonly
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
World of Warcraft --> C:\Program Files\Common Files\Blizzard Entertainment\WORLD OF WARCRAFT (2)\Uninstall.exe
-- Application Event Log -------------------------------------------------------
Event Record #/Type4492 / Warning
Event Submitted/Written: 07/03/2008 02:09:40 AM
Event ID/Source: 4113 / Avira AntiVir
Event Description:
TR/BHO.GenC:\Windows\System32\MGFPMCE.dll
Event Record #/Type4490 / Error
Event Submitted/Written: 07/02/2008 11:34:43 PM
Event ID/Source: 5007 / WerSvc
Event Description:
Die Zieldatei für die Windows-Feedbackplattform (eine DLL-Datei, die eine Liste der auf diesem Computer aufgetretenen Probleme enthält, für deren Diagnose das Sammeln zusätzlicher Daten erforderlich ist) konnte nicht analysiert werden. Fehlercode 8014FFF9.
Event Record #/Type4482 / Success
Event Submitted/Written: 07/02/2008 10:34:50 PM
Event ID/Source: 5617 / WinMgmt
Event Description:
Event Record #/Type4481 / Success
Event Submitted/Written: 07/02/2008 10:34:48 PM
Event ID/Source: 5615 / WinMgmt
Event Description:
Event Record #/Type4479 / Success
Event Submitted/Written: 07/02/2008 10:34:47 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
Der Softwarelizenzierungsdienst wurde gestartet.
-- Security Event Log ----------------------------------------------------------
No Errors/Warnings found.
-- System Event Log ------------------------------------------------------------
Event Record #/Type12046 / Warning
Event Submitted/Written: 07/03/2008 01:04:25 AM
Event ID/Source: 57 / volmgr
Event Description:
Die Daten konnten nicht in das Transaktionsprotokoll verschoben werden. Möglicherweise sind die Daten beschädigt.
Event Record #/Type12045 / Warning
Event Submitted/Written: 07/03/2008 00:41:55 AM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP hat das Sicherheitslimit erreicht, das für die Anzahl gleichzeitiger TCP-Verbindungsversuche festgelegt wurde.
Event Record #/Type12044 / Warning
Event Submitted/Written: 07/03/2008 00:19:20 AM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP hat das Sicherheitslimit erreicht, das für die Anzahl gleichzeitiger TCP-Verbindungsversuche festgelegt wurde.
Event Record #/Type12043 / Warning
Event Submitted/Written: 07/02/2008 11:06:42 PM
Event ID/Source: 57 / volmgr
Event Description:
Die Daten konnten nicht in das Transaktionsprotokoll verschoben werden. Möglicherweise sind die Daten beschädigt.
Event Record #/Type11944 / Error
Event Submitted/Written: 07/02/2008 10:34:41 PM
Event ID/Source: 6008 / EventLog
Event Description:
Das System wurde zuvor am 02.07.2008 um 22:30:58 unerwartet heruntergefahren.
-- End of Deckard's System Scanner: finished at 2008-07-03 03:36:38 ------------
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 02:48
| #9 |
| > MalwareDB | TR/BHO.Gen und andere echt ätzende Dinge Sehr schön, jetzt haben wir die Avira Meldung. Nun suchen wir mal nach Dateien. Vistafindbat - download von VistaFindbat. zip auf Deinen desktop - öffne mit einem doppelklick die zip datein - starte mit einem rechtsklick auf die datei vistafind.bat (als administrator starten) das stapelverarbeitungsprogramm - Dein bevorzugtes textverarbeitungsprogramm wird sich öffnen - markiere den inhalt und füge in hier im forum in deinem beitrag ein. wichtig: logfile bitte im tag (das Raute Symbol) posten - formatiere nun Deinen beitrag vor dem speichern, in dem du alle texte, die ein älteres datum besitzen, als die letzten 30 tage, aus der liste löscht. das sind alle verzeichnisse, die mit dieserVistaFind.bat ausgelesen werden. Verzeichnis von C:\ Verzeichnis von C:\WINDOWS Verzeichnis von C:\WINDOWS\system Verzeichnis von C:\WINDOWS\system32 --> von hier bitte alles posten Verzeichnis von C:\USER\Name\Temp Verzeichnis von C:\WINDOWS\Prefetch Verzeichnis von C:\WINDOWS\tasks Verzeichnis von C:\USER\Name\Temp Verzeichnis von C:\Program Files\ --> hier alles posten lösche die datei vistafind.txt Ist die Datei zu groß, lade sie bei File-Upload.net - Ihr kostenloser File Hoster! hoch und poste den Link.
__________________ If every computer is running a diverse ecosystem, crackers will have no choice but to resort to small-scale, targetted attacks, and the days of mass-market malware will be over[...]. Stuart Udall |
|
03.07.2008, 03:05
| #10 |
| | TR/BHO.Gen und andere echt ätzende Dinge http://www.file-upload.net/download-953052/VistaFind.txt.html hoffe ich habs richtig gemacht
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 03:14
| #11 |
| > MalwareDB | TR/BHO.Gen und andere echt ätzende Dinge ich finde auch in diesem Filelist keinen Hinweis auf eine Infektion. Ich möchte Dein System möglichst nicht beinflussen, daher erst mal ein Scan mit Deinem Avira. Das System nun mit Avira (vorher updaten und wie hier beschrieben einstellen) scannen. Den Scanbericht hier posten, es kann durchaus sein das noch Kopien in der Systemwiederherstellung zu finden sind. Nach dem scannen, setzte die Einstellungen (Heuistik) wieder zurück sie sind nicht ganz alltagstauglich. Dann bitte einen Online Scan mit dem Kaspersky Online Scanner. Link Beide Ergebnisse dann hier posten, wird wohl was dauern.
__________________ If every computer is running a diverse ecosystem, crackers will have no choice but to resort to small-scale, targetted attacks, and the days of mass-market malware will be over[...]. Stuart Udall |
|
03.07.2008, 03:16
| #12 |
| | TR/BHO.Gen und andere echt ätzende Dinge alles klärchen, werde ich morgen sobald ich kann erledigen muss jetzt noch kurz schlafen hab um halb 9 schon wieder n termin. danke dir erstmal für den bisherigen support!!!!
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
03.07.2008, 19:07
| #13 |
| | TR/BHO.Gen und andere echt ätzende Dinge Avira AntiVir Personal Report file date: Donnerstag, 3. Juli 2008 18:13 Scanning for 1376780 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows Vista Windows version: (plain) [6.0.6000] Boot mode: Normally booted Username: SYSTEM Computer name: KIEZMIEZ-PC Version information: BUILD.DAT : 8.1.0.308 16478 Bytes 28.05.2008 17:03:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18.03.2008 09:02:56 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07.02.2008 08:43:37 LUKE.DLL : 8.1.2.9 151809 Bytes 28.02.2008 08:41:23 LUKERES.DLL : 8.1.2.1 12033 Bytes 21.02.2008 08:28:40 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18.07.2007 10:33:34 ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24.06.2008 21:22:55 ANTIVIR2.VDF : 7.0.5.20 142336 Bytes 30.06.2008 21:18:58 ANTIVIR3.VDF : 7.0.5.45 115712 Bytes 03.07.2008 16:13:25 Engineversion : 8.1.0.64 AEVDF.DLL : 8.1.0.5 102772 Bytes 25.02.2008 09:58:21 AESCRIPT.DLL : 8.1.0.46 283002 Bytes 02.07.2008 21:19:02 AESCN.DLL : 8.1.0.22 119157 Bytes 27.06.2008 21:23:38 AERDL.DLL : 8.1.0.20 418165 Bytes 18.05.2008 19:58:35 AEPACK.DLL : 8.1.1.6 364918 Bytes 27.06.2008 21:23:37 AEOFFICE.DLL : 8.1.0.20 192891 Bytes 27.06.2008 21:23:32 AEHEUR.DLL : 8.1.0.35 1298806 Bytes 02.07.2008 21:19:01 AEHELP.DLL : 8.1.0.15 115063 Bytes 30.05.2008 07:37:05 AEGEN.DLL : 8.1.0.29 307573 Bytes 27.06.2008 21:23:13 AEEMU.DLL : 8.1.0.6 430451 Bytes 18.05.2008 19:58:28 AECORE.DLL : 8.1.0.32 168311 Bytes 02.07.2008 21:18:58 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23.01.2008 17:07:53 AVPREF.DLL : 8.0.0.1 25857 Bytes 18.02.2008 10:37:50 AVREP.DLL : 7.0.0.1 155688 Bytes 16.04.2007 13:26:47 AVREG.DLL : 8.0.0.0 30977 Bytes 23.01.2008 17:07:49 AVARKT.DLL : 1.0.0.23 307457 Bytes 12.02.2008 08:29:23 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28.02.2008 08:31:31 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22.01.2008 17:28:02 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23.01.2008 17:08:39 NETNT.DLL : 8.0.0.1 7937 Bytes 25.01.2008 12:05:10 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10.03.2008 14:37:25 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06.03.2008 12:02:11 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: off Smart extensions.................: on Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, Macro heuristic..................: on File heuristic...................: high Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR, Start of the scan: Donnerstag, 3. Juli 2008 18:13 Starting search for hidden objects. '58838' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'TrustedInstaller.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'CCC.exe' - '1' Module(s) have been scanned Scan process 'FNPLicensingService.exe' - '1' Module(s) have been scanned Scan process 'WmiPrvSE.exe' - '1' Module(s) have been scanned Scan process 'daemon.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'acrotray.exe' - '1' Module(s) have been scanned Scan process 'MOM.exe' - '1' Module(s) have been scanned Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned Scan process 'unsecapp.exe' - '1' Module(s) have been scanned Scan process 'RtHDVCpl.exe' - '1' Module(s) have been scanned Scan process 'MGSysCtrl.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'dwm.exe' - '1' Module(s) have been scanned Scan process 'taskeng.exe' - '1' Module(s) have been scanned Scan process 'SearchIndexer.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'PsiService_2.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'o2flash.exe' - '1' Module(s) have been scanned Scan process 'edd.exe' - '1' Module(s) have been scanned Scan process 'NBService.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'agrsmsvc.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'SLsvc.exe' - '1' Module(s) have been scanned Scan process 'audiodg.exe' - '0' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'Ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'lsm.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'wininit.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 56 processes with 56 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '18' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\Windows\System32\drivers\sptd.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: Donnerstag, 3. Juli 2008 19:13 Used time: 1:00:02 min The scan has been done completely. 19292 Scanning directories 348722 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 3 Files cannot be scanned 348722 Files not concerned 889 Archives were scanned 3 Warnings 0 Notes 58838 Objects were scanned with rootkit scan 0 Hidden objects were found avira-report
__________________ *Ein Rabe geht im Feld spazieren, da fällt der Weizen um.* |
|
04.07.2008, 08:33
| #14 |
| | TR/BHO.Gen und andere echt ätzende Dinge [edit] bitte eröffne, wie jeder andere hier auch, für dein problem einen eigenen beitrag nur so wird sichergestellt, das jedem user übersichtlich und individuell geholfen werden kann danke GUA  [/edit] Geändert von pechmarie (04.07.2008 um 08:42 Uhr) |
|
05.07.2008, 16:41
| #15 |
| > MalwareDB | TR/BHO.Gen und andere echt ätzende Dinge KIEZMIEZ: Das Avira Log zeigt auch keine Infektion, ich tippe immer noch auf einen Fehlalarm. Wenn Du möchtest kannst Du noch den Onlinescan bei Kaspersky machen. pechmarie: Bitte erstelle einen eigenen Thread.
__________________ If every computer is running a diverse ecosystem, crackers will have no choice but to resort to small-scale, targetted attacks, and the days of mass-market malware will be over[...]. Stuart Udall |
|
| Themen zu TR/BHO.Gen und andere echt ätzende Dinge |
| andere, avira, desktop, dinge, doofe, einfach, entdeck, film, laptop, liebe, lieben, neue, outlook, problem, rechner, rechts, schafft, schmiert, shortcut, tagen, taste, tasten, thunderbird, tr/bho.gen, troja, trojaner |
Linear-Darstellung
