| |
| |||||||
Log-Analyse und Auswertung: HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
21.07.2008, 07:59
| #1 |
| |  HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com) Hallo habe plötzlich das Problem, dass ich konstante Werbepopups unter IE erhlate und im Firefox sich ständig neue Fenster öffnen. Das System ist auch etwas langsamer. Hinundwieder öffnet sich ein FEsnter, dass mir mitteilt, dass ich mir auf pc-on-internet.com/gad-network.com ein Antispywareproggi besorgen soll. Ich traue dem nicht wirklich, etwas googeln hat mir das auch noch unterstrichen. Bisher habe ich Malwarebytes laufen lassen, stürzt aber leider ab. Dann habe ich SUPERAntiSpyware laufen lassen und nur Cookies finden können und diese vernichtet. Schlussendlich habe ich DSS gestartet und nun poste ich das Log hier. Wäre super, wenn ich nicht "format" anwenden müsste. Vielen Dank für eure Mühen. Code:
ATTFilter Deckard's System Scanner v20071014.68 Run by NAME on 2008-07-21 08:03:11 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as NAME.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:03:41, on 21.07.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\ASUS\ATK Media\DMedia.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Skype\Phone\Skype.exe C:\Windows\System32\rundll32.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Users\NAME\AppData\Local\ydozehbm.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Users\NAME\Downloads\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\NAME.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/ig?hl=de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ydozehbm] c:\users\NAME\appdata\local\ydozehbm.exe ydozehbm O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: AirLive WL-5480USB WLAN USB Utility.lnk = C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - h**p://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - h**p://www.adobe.com/products/acrobat/nos/gp.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: SoundMovieServer - SoundMovieServer - C:\Windows\system32\snmvtsvc.exe -- End of file - 9430 bytes -- Files created between 2008-06-21 and 2008-07-21 ----------------------------- 2008-07-20 21:46:39 0 d-------- C:\Users\All Users\SUPERAntiSpyware.com 2008-07-20 21:46:18 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-07-20 21:45:49 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-20 21:39:22 0 -rahs---- C:\MSDOS.SYS 2008-07-20 21:39:22 0 -rahs---- C:\IO.SYS 2008-07-20 20:57:23 0 d-------- C:\Users\All Users\Malwarebytes 2008-07-20 20:57:22 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-20 20:44:04 0 d-------- C:\Program Files\Trend Micro 2008-07-19 19:53:31 0 d-------- C:\Users\All Users\Spybot - Search & Destroy 2008-07-19 12:00:10 0 d-------- C:\PerfLogs 2008-07-14 23:13:41 0 d-------- C:\Program Files\WebMediaPlayer 2008-07-07 19:41:28 0 d-------- C:\Program Files\POI-Warner 3 GoPal Edition 2008-07-06 20:18:59 0 d-------- C:\Program Files\VideoLAN 2008-06-26 15:32:54 0 d-------- C:\GS 2008-06-26 15:32:53 0 d-------- C:\Program Files\Common Files\MAYComputer 2008-06-23 13:57:43 0 d-------- C:\Users\All Users\Apple -- Find3M Report --------------------------------------------------------------- 2008-07-21 08:03:20 618430 --a------ C:\Windows\system32\perfh007.dat 2008-07-21 08:03:20 122648 --a------ C:\Windows\system32\perfc007.dat 2008-07-21 07:58:55 49445 --a------ C:\Users\NAME\AppData\Roaming\nvModes.dat 2008-07-21 07:58:53 49445 --a------ C:\Users\NAME\AppData\Roaming\nvModes.001 2008-07-21 00:48:35 0 d-------- C:\Users\NAME\AppData\Roaming\Skype 2008-07-20 23:46:54 836 --a------ C:\Windows\bthservsdp.dat 2008-07-20 23:46:10 0 d-------- C:\Program Files\GV Everest Pokernet 2008-07-20 21:46:18 0 d-------- C:\Users\NAME\AppData\Roaming\SUPERAntiSpyware.com 2008-07-20 21:45:49 0 d-------- C:\Program Files\Common Files 2008-07-20 20:57:29 0 d-------- C:\Users\NAME\AppData\Roaming\Malwarebytes 2008-07-20 20:37:31 0 d-------- C:\Users\NAME\AppData\Roaming\Real 2008-07-20 16:03:07 0 d-------- C:\Users\NAME\AppData\Roaming\skypePM 2008-07-20 15:22:11 40 ---hs---- C:\Users\NAME\AppData\Roaming\.zreglib 2008-07-19 12:10:34 174 --ahs---- C:\Program Files\desktop.ini 2008-07-19 12:02:12 0 d-------- C:\Program Files\Windows Sidebar 2008-07-19 12:02:12 0 d-------- C:\Program Files\Windows Calendar 2008-07-19 12:02:12 0 d-------- C:\Program Files\Movie Maker 2008-07-19 12:02:11 0 d-------- C:\Program Files\Windows Mail 2008-07-19 12:02:10 0 d-------- C:\Program Files\Windows Photo Gallery 2008-07-19 12:02:10 0 d-------- C:\Program Files\Windows Collaboration 2008-07-19 12:02:09 0 d-------- C:\Program Files\Windows Journal 2008-07-19 12:02:04 0 d-------- C:\Program Files\Windows Defender 2008-07-09 21:37:03 0 d-------- C:\Users\NAME\AppData\Roaming\Mozilla 2008-07-06 20:21:38 0 d-------- C:\Users\NAME\AppData\Roaming\vlc 2008-07-03 08:42:11 0 d-------- C:\Program Files\Java 2008-06-26 15:33:34 0 d-------- C:\Users\NAME\AppData\Roaming\eDocPrintPro 2008-06-23 13:57:43 0 d-------- C:\Program Files\Apple Software Update 2008-06-11 17:33:51 0 d-------- C:\Users\NAME\AppData\Roaming\Adobe 2008-05-27 20:43:55 0 d-------- C:\Program Files\Common Files\Skype -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [19.01.2008 09:38] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [09.10.2006 13:43] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [22.11.2006 07:27] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [18.07.2008 08:28] "ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [02.11.2006 08:27] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22.02.2008 04:25] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [12.01.2006 15:40] "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [14.12.2004 02:12] "@"="" [] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [16.03.2007 11:45] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [29.06.2007 06:24] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02.04.2008 22:20] "NvSvc"="C:\Windows\system32\nvsvc.dll" [19.12.2006 07:38] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [19.12.2006 07:38] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [19.12.2006 07:38] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [19.01.2008 09:33] "WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" [] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [23.04.2008 17:45] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [15.01.2007 16:14] "ydozehbm"="c:\users\NAME\appdata\local\ydozehbm.exe" [14.07.2008 23:13] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07.07.2008 09:42] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [28.05.2008 10:33] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - C:\Windows\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe [15.05.2007 13:39:40] Adobe Reader - Schnellstart.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [23.10.2006 01:48:20] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [23.10.2006 00:01:50] AirLive WL-5480USB WLAN USB Utility.lnk - C:\Program Files\AirLive WL-5480USB WLAN USB\AirLive WL-5480USB WLAN USB\WlanUtil.exe [15.05.2008 12:42:35] VPN Client.lnk - C:\Windows\Installer\{871DF2BE-41D2-4334-AC33-839AF16FC8FE}\Icon3E5562ED7.ico [15.05.2008 14:55:22] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) "EnableUIADesktopToggle"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [13.05.2008 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19.04.2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry Winh**pAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE WebClient SstpSvc LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc CscService TabletInputService UmRdpService wlansvc WPDBusEnum EMDMgmt LocalServiceNoNetwork PLA DPS BFE mpssvc LocalServiceNetworkRestricted DHCP eventlog AudioSrv LmHosts wscsvc p2pimsvc PNRPSvc p2psvc PnrpAutoReg bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38faf3a0-429e-11dd-9890-0018f3d8517c}] AutoRun\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe open\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4d67f93b-4422-11dd-9b66-0018f3d8517c}] AutoRun\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe open\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53d468e3-4939-11dd-a5ca-004f660037a2}] AutoRun\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe open\command- RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\usb323.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b0f0f13-3b0b-11dd-a1f1-0018f3d8517c}] AutoRun\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe open\command- F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-07-21 08:04:07 ------------ |
|
22.07.2008, 12:05
| #2 |
| | HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com) Hallo miteinander,
__________________mein beschriebenes Problem scheint so einige zu plagen. Ich habe Navilog1 auf meinem System ausgeführt und auch was gefunden. Soll ich das nun mit Navilog1 und dem Menüpunkt 2 ("automatisches fixen") beheben. Ich habe leider nicht viel Ahnung und das Programm rät einem ja auch, erst Rücksprache zu halten. Hier der Logfile: Code:
ATTFilter Search Navipromo version 3.6.1 began on 22.07.2008 at 12:05:56,26
!!! Warning, this report may include legitimate files/programs !!!
!!! Post this report on the forum you are being helped !!!
!!! Don't continue with removal unless instructed by an authorized helper !!!
Fix running from C:\Program Files\navilog1
Actual User Account : "*NAME*"
Updated on 19.07.2008 at 20h00 by IL-MAFIOSO
Microsoft Windows Vista 6.0.6001
Version Internet Explorer : 7.0.6001.18000
Filesystem type : NTFS
Search done in normal mode
*** Searching for installed Software ***
*** Search folders in "C:\Windows" ***
*** Search folders in "C:\Program Files" ***
*** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" ***
*** Search folders in "c:\progra~2\micros~1\windows\startm~1" ***
*** Search folders in "C:\ProgramData" ***
*** Search folders in "c:\users\*NAME*\appdata\roaming\micros~1\windows\startm~1\programs" ***
*** Search folders in "C:\Users\*NAME*\AppData\Local\virtualstore\Program Files" ***
*** Search folders in "C:\Users\*NAME*\AppData\Roaming" ***
*** Search with Catchme-rootkit/stealth malware detector by gmer ***
for more info : http://www.gmer.net
No Navipromo file found
*** Search with GenericNaviSearch ***
!!! Possibility of legitimate files in the result !!!
!!! Must always be checked before manually deleting !!!
* Scan in "C:\Windows\system32" *
* Scan in "C:\Users\*NAME*\AppData\Local\Microsoft" *
* Scan in "C:\Users\*NAME*\AppData\Local\virtualstore\windows\system32" *
* Scan in "C:\Users\*NAME*\AppData\Local" *
Files found :
ydozehbm.exe found !
ydozehbm.dat found !
ydozehbm.bat found !
ydozehbm_nav.dat found !
ydozehbm_navps.dat found !
*** Search files ***
*** Search specific Registry keys ***
*** Complementary Search ***
(Search specific files)
1)Search new Instant Access files :
2)Heuristic Search :
* In "C:\Windows\system32" :
* In "C:\Users\*NAME*\AppData\Local\Microsoft" :
* In "C:\Users\*NAME*\AppData\Local\virtualstore\windows\system32" :
* In "C:\Users\*NAME*\AppData\Local" :
ydozehbm_nav.dat found !
ydozehbm_navps.dat found !
3)Certificates Search :
Egroup certificate found !
Electronic-Group certificate found !
OOO-Favorit certificate found !
Sunny-Day-Design-Ltd certificate not found !
4)Search known files :
*** Search completed on 22.07.2008 at 12:21:36,98 ***
Code:
ATTFilter ydozehbm.exe found !
ydozehbm.dat found !
ydozehbm.bat found !
ydozehbm_nav.dat found !
ydozehbm_navps.dat found !
Gruss, Sternhauer |
|
22.07.2008, 13:19
| #3 |
| | HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com) So weg ist er. Das Ding hieß Navipromo. Auch wenn ich nicht wirklich Unterstützung hier erfahren habe muss ich doch wenigstens feststellen, dass eine ausführliche Recherche auf diesem Board auch zur Lösung meines Problems geführt hat.
__________________Gruss, Sternhauer |
|
| Themen zu HiJackThis Logfile bitte um Hilfe (gad-network.com / pc-on-internet.com) |
| antivir, avira, bho, bitte um hilfe, components, downloader, excel, firefox, format, gservice, hijack, hijackthis, hijackthis logfile, installation, internet explorer, konvertieren, lanmanworkstation, logfile, object, pdf-datei, problem, programdata, registry, rundll, scan, software, start menu, svchost, system, trustedinstaller, usb, vielen dank, vista, windows, windows defender, windows sidebar, wlansvc |
Linear-Darstellung
