Hallo an Alle erstmal, ich hoffe hier findet sich jemand, der es mir ersparen kann mein System neu aufzusetzen.
Gestern Abend hab ich mich mit Antivirus 2008 beschäftigen müssen, weil mein avast immer wieder wissen wollte wie es mit einer "pphccdmj0eccg.exe" umgehen soll. Die Antwort war egal, denn die Meldung kam immer wieder.
Also bin ich hier aufs Board und hab schon mehrere empfohlene Programme durchlaufen lassen. Ich seh auch nichts mehr von dem Antivirus 2008 programm, aber ich habe noch das Hintergrundbild mit "Warning! Spyware..." im Zentrum. Jetzt wollt ich das Hintergrundbild manuell ändern, da fällt mir auf, daß 2 Registrierkarten verschwunden sind in "Eigenschaften von Anzeige" (Bildschirmschoner und Desktophintergrund).
Kann man die Registrierkarten wiederherstellen?
Hab ich mich evtl. nicht von Antivirus XP 2008 befreien können?
Würde sich mal jemand mein HJT-log anschauen und das beurteilen bitte.
Zitat:
StartupList report, 29.07.2008, 10:29:10
StartupList version: 1.52.2
Started from : C:\Programme\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.16674)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Nero\Nero 7\InCD\InCD.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AGEIA Technologies\bin\TrayIcon.exe
C:\Programme\DAEMON Tools Lite\daemon.exe
C:\Programme\ICQ6\ICQ.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe
C:\Program Files\WinFast\WFDTV\WFWIZ.exe
C:\Programme\Adobe\Distillr\acrotray.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\OpenOffice.org 2.2\program\soffice.exe
C:\Programme\OpenOffice.org 2.2\program\soffice.BIN
C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Dokumente und Einstellungen\user\Startmenü\Programme\Autostart]
OpenOffice.org 2.2.lnk = C:\Programme\OpenOffice.org 2.2\program\quickstart.exe
Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]
Acrobat Assistant.lnk = C:\Programme\Adobe\Distillr\acrotray.exe
Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HPDJ Taskbar Utility = C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
avast! = C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
TerraTec Remote Control = "C:\Programme\Gemeinsame Dateien\TerraTec\Remote\TTTvRc.exe"
InCD = C:\Programme\Nero\Nero 7\InCD\InCD.exe
zBrowser Launcher = C:\Programme\Logitech\iTouch\iTouch.exe
Logitech Hardware Abstraction Layer = KHALMNPR.EXE
RTHDCPL = RTHDCPL.EXE
SkyTel = SkyTel.EXE
Alcmtr = ALCMTR.EXE
SunJavaUpdateSched = "C:\Programme\Java\jre6\bin\jusched.exe"
StartCCC = "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
QuickTime Task = "C:\Programme\QuickTime\qttask.exe" -atboottime
WinFastDTV = C:\Program Files\WinFast\WFDTV\DTVSchdl.exe
ArcSoft Connection Service = C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AlcoholAutomount = "C:\Programme\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
AnyDVD = C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
AGEIA PhysX SysTray = C:\Programme\AGEIA Technologies\bin\TrayIcon.exe
DAEMON Tools Lite = "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
ICQ = "C:\Programme\ICQ6\ICQ.exe" silent
ISUSPM = "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler
WinFast Schedule = C:\Program Files\WinFast\WFDTV\WFWIZ.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\WIN.INI:
load=*INI section not found*
run=*INI section not found*
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=C:\WINDOWS\system32\__c00214E1.dat
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\blphccdmj0eccg.scr <------hab ich schon entfernt
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Download Program Files:
[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Adobe\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
[TmHcmsX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\TmHcmsX.ocx
CODEBASE = http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
[ActiveScan 2.0 Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\as2stubie.dll
CODEBASE = http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
[BDSCANONLINE Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\oscan82.ocx
CODEBASE = http://download.bitdefender.com/resources/scan8/oscan8.cab
[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
[MSN Games - Installer]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx
CODEBASE = http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx
CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOKUME~1\user\Cookies\index.dat||C:\DOKUME~1\user\LOKALE~1\Temp\~nsu.tmp\Au_.exe||C:\DOKUME~1\user\LOKALE~1\Temp\~nsu.tmp
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll
--------------------------------------------------
End of report, 9.288 bytes
Report generated in 0,047 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
|
MfG
janfleet
29.07.2008, 10:34
Linear-Darstellung
