| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virtumonde entfernen - welcher Weg ist der richtige?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
01.01.2009, 22:07
| #1 |
| |  Virtumonde entfernen - welcher Weg ist der richtige? Hallo, liebe Forianer! Da ich in älteren Virtumonde-Threads gelesen habe, dass jeder User einen eigenen Thread starten soll, mache ich das mal und hoffe, dass es so ok ist. Auch ich habe mir den fiesen Virtumonde Trojaner eingefangen  und habe mithilfe von google bereits soviele verschiedene Anleitungen gefunden, die man befolgen soll, dass mir schon der Kopf schwirrt. Spybot S&D kann ihn nicht permanent entfernen. Sogar vor dem Neustart geht der virtumonde-Spaß weiter. Avast! wurde irgendwo empfohlen, aber auch er hat bisher nichts gebracht. Ich benutze Windows XP Home Edition, Comodo Firewall, AVG Antivirus, neuerdings auch Avast!. CCleaner habe ich bereits installiert. ComboFix läuft bei mir nicht 332788R22FW22FW\hidec.exe Auf das angegebene Gerät, bzw. den Pfad oder die Datei kann nicht zugegriffen werden. Sie verfügen eventuell nicht über ausreichende Berechtigungen, um auf das Element zugreifen zu können. Kann es sein, dass ich das durch eine Firewall oder Spybot verhindert habe? Im Übrigen konnte ich das Windows Service Pack 3 nicht installieren. Dies war, bevor ich mir Virtumonde eingefangen habe. Nach dem Neustart der Service Pack 3-Installation kam ich nicht mehr in meine graphische Oberfläche rein, weil die Lizenz nicht überprüft werden konnte (ich habe ein Originalwindows, allerdings keine CDs dafür, der Laptop wurde so geliefert). D.h. Service Pack 3 habe ich noch nicht installiert! Nachfolgend mein HijackThis Log-File: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:42:19, on 01.01.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\hkcmd.exe C:\Programme\Synaptics\SynTP\SynTPLpr.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Programme\SAMSUNG\SENS Keyboard V4 Launcher\SENSKBD.EXE C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Programme\Wallpaper Master\Wallpaper.exe C:\Programme\FreePDF_XP\fpassist.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Programme\Windows Live\Messenger\MsnMsgr.Exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\ICQ6\ICQ.exe C:\WINDOWS\system32\spoolsv.exe c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\COMODO\Firewall\cmdagent.exe C:\Programme\tintinyproxyy\tinyproxy.exe C:\WINDOWS\system32\svchost.exe C:\Programme\UPHClean\uphclean.exe C:\Programme\Mozilla Thunderbird\thunderbird.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\Windows Live\Messenger\usnsvc.exe C:\Programme\PrevxCSI\prevxcsi.exe C:\Programme\PrevxCSI\prevxcsi.exe C:\Programme\_my_programmes\firefox\firefox.exe C:\32788R22FWJFW\GSAR.cfexe C:\Programme\AVG\AVG8\avgtray.exe C:\Programme\Alwil Software\Avast4\ashMaiSv.exe C:\Programme\Alwil Software\Avast4\ashWebSv.exe C:\Programme\COMODO\Firewall\cfp.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = h**p=127.0.0.1:9090 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local> O1 - Hosts: 65.54.239.80 dp.msnmessenger.akadns.net O1 - Hosts: 89.149.226.178 wiki.d-addicts.com O2 - BHO: (no name) - {064275DD-4266-474C-A7EA-DE71F909CA02} - C:\WINDOWS\system32\jkkLCrpn.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53- 2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\xxyyxuTj.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF- 8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SENS Keyboard V4 Launcher] "C:\Programme\SAMSUNG\SENS Keyboard V4 Launcher\SENSKBD.EXE" O4 - HKLM\..\Run: [CamMonitor] c:\Programme\Hewlett- Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32 \igfxpers.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1 \IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32 \IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32 \IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32 \IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32 \dumprep 0 -k O4 - HKLM\..\Run: [WallpaperChanger] C:\Programme\Wallpaper Master\Wallpaper.exe O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Programme\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8 \avgtray.exe O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Programme\COMODO\Firewall\cfp.exe" -h O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4 \ashDisp.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32 \CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32 \CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32 \CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32 \CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5- 00401C608501} - C:\Programme\Java\jre1.5.0_02 \bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0- 4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02 \bin\npjpi150_02.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE- 3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200- 58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7- f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA- FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA -FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E- 00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910- F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - h**p://***.spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - h**p://download.autodesk.com/esd/mapguide/SP1/ENG/mgaxctrl.ca b O16 - DPF: {A0E7D0C1-9854-497E-8645-38C19AA00724} (IssacWebSE Class) - h**p://www.teenkorean.net/Penta/KoreanSecurity.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/sw flash.cab O18 - Protocol: bw+0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80- C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {95C8FAC2-C0A3-4694-A2F8-852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480 \Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1- FBDDE494F8D1} - C:\Programme\AVG\AVG8\avgpp.dll O18 - Protocol: offline-8876480 - {95C8FAC2-C0A3-4694-A2F8- 852AAB94A5D2} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458- 1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: xxyyxuTj - xxyyxuTj.dll (file missing) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4 \aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32 \bgsvcgen.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Programme\COMODO\Firewall\cmdagent.exe O23 - Service: CSIScanner - Prevx - C:\Programme\PrevxCSI\prevxcsi.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Programme\WinPcap\rpcapd.exe O23 - Service: Samsung Update Plus - Unknown owner - C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe O23 - Service: Sekundäre Anmeldung (seclogon) - Unknown owner - C:\Programme\tintinyproxyy\tinyproxy.exe (file missing) O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe -- End of file - 22151 bytes Ich hoffe, Ihr könnt mir helfen. Dachte, ich werde mich nach den Feiertagen mit dem Service Pack 3-Problem beschäftigen, aber jetzt muss ich erstmal den Virtumonde loswerden... Vielen Dank im Voraus  |
| Themen zu Virtumonde entfernen - welcher Weg ist der richtige? |
| ad-aware, avast!, avg antivirus, bho, bonjour, combofix, comodo internet security, computer, desktop, e-mail, entfernen, excel, feiertage, fiese, firefox, geliefert, google, hijack, hijackthis, hkus\s-1-5-18, home, internet security, logfile, mozilla thunderbird, nicht installiert, security, software, starten, symantec, system, trojaner, trojaner eingefangen, virtumonde, windows, windows xp |
Baum-Darstellung