![]() |
|
Log-Analyse und Auswertung: Brauch Hilfe zu Google Redirect VirusWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() |
|
![]() | #1 |
| ![]() Brauch Hilfe zu Google Redirect Virus Hallo, Google leitet auf falsche Seiten weiter. Hab' mich im Forum ![]() 1. CCleaner (sieht sauber aus) 2. Malwarebaytes-Anti-Malware (infizierte Datein gefunden, s.u.; anschließend behoben) 3. HijackThis. Hier die Log-Files (s.u.) 4. Liste der installierten Programme (s.u.) Wäre super, wenn mich jemand unterstützen könnte, den lästigen Virus loszuwerden. Dank für Eure Mühe im Voraus. Malwarebytes' Anti-Malware 1.38 Datenbank Version: 2297 Windows 6.0.6001 Service Pack 1 06.07.2009 06:17:25 mbam-log-2009-07-06 (06-17-15).txt Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|G:\|H:\|) Durchsuchte Objekte: 404353 Laufzeit: 2 hour(s), 9 minute(s), 14 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 1 Infizierte Verzeichnisse: 0 Infizierte Dateien: 21 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Hans\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\7HP09I75\installer_70141[1].exe (Rogue.Installer) -> No action taken. c:\Users\Admin\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Public\Desktop\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken. c:\Users\Public\Desktop\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken. C:\Windows\System32\dmns.cfg (Rogue.AntiVirusPro) -> No action taken. C:\Windows\System32\avp.id (Rogue.AntiVirusPro) -> No action taken. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:17:33, on 11.07.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Windows\Samsung\PanelMgr\SSMMgr.exe C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.exe C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.BIN C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: 89.149.210.104 w*w.google.com O1 - Hosts: 89.149.210.104 w*w.google.de O1 - Hosts: 89.149.210.104 w*w.google.fr O1 - Hosts: 89.149.210.104 w*w.google.co.uk O1 - Hosts: 89.149.210.104 w*w.google.com.br O1 - Hosts: 89.149.210.104 w*w.google.it O1 - Hosts: 89.149.210.104 w*w.google.es O1 - Hosts: 89.149.210.104 w*w.google.co.jp O1 - Hosts: 89.149.210.104 w*w.google.com.mx O1 - Hosts: 89.149.210.104 w*w.google.ca O1 - Hosts: 89.149.210.104 w*w.google.com.au O1 - Hosts: 89.149.210.104 w*w.google.nl O1 - Hosts: 89.149.210.104 w*w.google.co.za O1 - Hosts: 89.149.210.104 w*w.google.be O1 - Hosts: 89.149.210.104 w*w.google.gr O1 - Hosts: 89.149.210.104 w*w.google.at O1 - Hosts: 89.149.210.104 w*w.google.se O1 - Hosts: 89.149.210.104 w*w.google.ch O1 - Hosts: 89.149.210.104 w*w.google.pt O1 - Hosts: 89.149.210.104 w*w.google.dk O1 - Hosts: 89.149.210.104 w*w.google.fi O1 - Hosts: 89.149.210.104 w*w.google.ie O1 - Hosts: 89.149.210.104 w*w.google.no O1 - Hosts: 89.149.210.104 search.yahoo.com O1 - Hosts: 89.149.210.104 us.search.yahoo.com O1 - Hosts: 89.149.210.104 uk.search.yahoo.com O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\IPSBHO.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Users\xxxx\Downloads\Free Download Manager\iefdm2.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKCU\..\Run: [1&1 SMS-Manager] C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [Free Download Manager] D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe -autorun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx') O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe (User 'xxxx') O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1003\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx') O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - S-1-5-21-730465023-3478590947-2926549422-1001 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx') O4 - S-1-5-21-730465023-3478590947-2926549422-1001 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx') O4 - S-1-5-21-730465023-3478590947-2926549422-1003 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx') O4 - S-1-5-21-730465023-3478590947-2926549422-1003 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx') O4 - Startup: FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe O4 - Global Startup: FRITZ!DSL Startcenter.lnk = ? O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlall.htm O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlselected.htm O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dllink.htm O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html O8 - Extra context menu item: Videos mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlfvideo.htm O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - h**p://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - h**ps://juniper.net/dana-cached/sc/JuniperSetupClient.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files (x86)\Common Files\AVM\de_serv.exe (file missing) O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 14131 bytes Installierte Software: 1&1 SMS-Manager 1&1 SoftPhone abitEQ V1.1.1.2 Adobe Flash Player 10 ActiveX Adobe Reader 9.1 - Deutsch Anno 1701 Apple Software Update Aufstieg des Hexenkönigs™ AVM FRITZ!DSL AVM FRITZ!fax für FRITZ!Box Canon G.726 WMP-Decoder CANON iMAGE GATEWAY Task for ZoomBrowser EX Canon Internet Library for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon OpenPage Print Component Canon PowerShot RS-232C TWAIN Driver Canon RAW Image Task for ZoomBrowser EX Canon Utilities CameraWindow Canon Utilities CameraWindow DC Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX Canon Utilities MyCamera Canon Utilities MyCamera DC Canon Utilities PhotoStitch Canon Utilities RemoteCapture DC Canon Utilities RemoteCapture Task for ZoomBrowser EX Canon Utilities ZoomBrowser EX Canon ZoomBrowser EX Memory Card Utility Carnet d'activités À plus! 1 CCleaner (remove only) Creative MediaSource 5 Die Schlacht um Mittelerde™ II FlashMenu flatster FRITZ!Box Fujicolor Bestell-Software GameShadow Google Earth Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer Google Updater Green Line NEW 2 Bayern Sprachtrainer Kommunikation HALO 2 FÜR WINDOWS VISTA Hauppauge German Help Files and Resources Hauppauge WinTV Hauppauge WinTV Infrared Remote Hauppauge WinTV Scheduler Hauppauge WinTV Soft PVR HijackThis 2.0.2 Interaktiver Adventskalender InterVideo FilterSDK for Hauppauge Java(TM) 6 Update 13 Juniper Networks Setup Client Activex Control LIVE gaming on Windows Runtime Version 1.0.6027 LiveUpdate Notice (Symantec Corporation) Logitech Desktop Messenger Logitech SetPoint Malwarebytes' Anti-Malware Microsoft Halo Trial |
![]() | #2 |
/// Helfer-Team ![]() ![]() ![]() ![]() ![]() ![]() | ![]() Brauch Hilfe zu Google Redirect Virus Hallo hanksh
__________________![]() - Die Anweisungen bitte gründlich lesen und immer streng einhalten, da ich die Reihenfolge nach bestimmten Kriterien vorbereitet habe: 1. den Quarantäne Ordner überall leeren - Antivirus bzw Anti-Spy-Programm usw das Malwarebytes deinstallieren 2. Lade dir HostsXpert auf dem Desktop speichern & und entpacken
3.
am besten nutze den Code-Tags für deinen Post: vor dein log schreibst du:[code] hier kommt dein logfile rein dahinter:[/code] gruß Coverflow |
![]() | #3 |
| ![]() Brauch Hilfe zu Google Redirect Virus Hallo Coverflow,
__________________hab mich an die Anweisung gehalten. Hier das Ergebnis (Teil 1). Gruß hanksh ![]() Code:
ATTFilter SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 07/12/2009 at 09:49 PM Application Version : 4.26.1006 Core Rules Database Version : 3988 Trace Rules Database Version: 1928 Scan type : Complete Scan Total Scan Time : 01:24:14 Memory items scanned : 701 Memory threats detected : 0 Registry items scanned : 6151 Registry threats detected : 0 File items scanned : 53753 File threats detected : 375 Adware.Tracking Cookie C:\Users\Admin\AppData\Local\Temp\Low\Cookies\admin@doubleclick[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@serving-sys[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@adfarm1.adition[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@doubleclick[2].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@doubleclick[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bs.serving-sys[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bs.serving-sys[3].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@atdmt[2].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@serving-sys[2].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msnportal.112.2o7[1].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msnportal.112.2o7[2].txt C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@atdmt[1].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@adfarm1.adition[2].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@atdmt[1].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@msnportal.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@doubleclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv1.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wckiqpcpalo.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6whkiugazklp.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[5].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.matratzendiscount[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[6].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@alpha.adwaves[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[7].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.adserverhome[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[4].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tribalfusion[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.cnn[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.jugendherberge[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@arcor.122.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ehg-tiscover.hitbox[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@roitracking[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bridge1.admarketplace[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.adtechus[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.mlsat02[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.pointroll[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.71i[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.ganz-muenchen[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.adform[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webcount.feratel[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@meetupcom.122.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@allesklarcomag.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.tier[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tacoda[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bluestreak[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statse.webtrendslive[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracknet.twyn[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.easyad[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.proxad[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@web4.realtracker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hitbox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@admarketplace[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@rotator.adjuggler[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stat.dealtime[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas4.emediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@valueclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media.adrevolver[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@club.zanox[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ottotrialpopunders.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@fastclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.evendi[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statcounter[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ottogroup.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adopt.euroclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@indextools[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@data.coremetrics[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.testberichte[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@at.atwola[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserv.chirurgie-portal[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@m1.webstats.motigo[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.performance-adserver[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.adnet[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.1a-infosysteme[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.partnerbridge[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adrevolver[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a7.adserver01[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@overture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.verlag.henrich[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.bauerverlag[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediaflite[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@208.122.40[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.boreus[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adviva[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@flightstats[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hbxtracking.sueddeutsche[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@loyaltypartner.122.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@xiti[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[1].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@atdmt[2].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@doubleclick[1].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@im.banner.t-online[1].txt C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@msnportal.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@doubleclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediaflite[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ad-srv[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.teleint[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[4].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@content.yieldmanager[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euroclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv1.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.matratzendiscount[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.adserverhome[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.paypal[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.jugendherberge[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6whmiendzcgq.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wfk4sgajedp.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media-center.1und1[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tunefinder[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wfmyemcjmhq.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.radsport-aktiv[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@count.primawebtools[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.adform[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wbl4shd5wcp.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@overture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dbxtrackers[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dbxtrackers[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ambiweb[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad1.emediate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media6degrees[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.testberichte[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftinternetexplorer.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a2.adserver01[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.boreus[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wgkicocjsko.stats.esomniture[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.salebroker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@valueclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.klicktel[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.oneview[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@siemens.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.1a-infosysteme[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.dialogmediencenter[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stat.vattenfall[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a6.adserver01[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.partnerbridge[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.11880[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.traffictrack[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@vodafonegroup.122.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a7.adserver01[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ww3.shoshkeles[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.alpenverein[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@208.122.40[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@4stats[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@content.yieldmanager.edgesuite[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@cpx.mediascale[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@delivery.ads.coupling-media[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hbxtracking.sueddeutsche[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@unitymedia[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[1].txt |
![]() | #4 |
| ![]() Brauch Hilfe zu Google Redirect Virus ... und Teil 2 Code:
ATTFilter C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising.youdagames[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.net-games[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@at.atwola[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.ehapa[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.71i[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.ehapa[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@gjacket.adbureau[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tacoda[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftwindows.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@m1.webstats.motigo[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dmtracker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.easyad[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@casalemedia[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statse.webtrendslive[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tribalfusion[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bluestreak[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.adnet[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@server.cpmstar[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@rotator.adjuggler[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.gamershell[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads2.uclick[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.cdpoker[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@files.youporn[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.web-mediaplayer[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@pornhub[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@server.cpmstar[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@fastclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads-dev.youporn[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adstar-media[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.gamesbannernet[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@de2.komtrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.eurogrand[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.glispa[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[4].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.scribefire[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[3].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@web-mediaplayer[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads2.net2day[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftmachinetranslation.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.skykingscasino[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.loudsocial[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads3.net2day[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.sun[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@keygenguru[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads4.net2day[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediamayhemcorp[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.nordprovider[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.net2day[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.pro-advertise[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.adshopping[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@counter.live4members[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a3.adserver01[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a2.adserver01[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.salebroker[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertiser1.contextmatters[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.trackbar[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ambiweb[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@date.ventivmedia[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eaeacom.112.2o7[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media6degrees[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracknet.twyn[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@usenext.softonic[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[1].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@windowsmedia[1].txt |
![]() | #5 |
/// Helfer-Team ![]() ![]() ![]() ![]() ![]() ![]() | ![]() Brauch Hilfe zu Google Redirect Virus hi poste bitte erneut ein neu erstellte HijackThis-Logfile |
![]() | #6 |
| ![]() Brauch Hilfe zu Google Redirect Virus Hallo Coverflow, hier das neu erstellte HiJack-Logfile. Gruß hanksh Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:11:26, on 13.07.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files (x86)\WinTV\Ir.exe C:\Program Files (x86)\FRITZ!DSL\StCenter.exe C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Windows\Samsung\PanelMgr\SSMMgr.exe C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.exe C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.BIN c:\program files (x86)\common files\installshield\updateservice\isuspm.exe C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\agent.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135 \IPSBHO.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642 \swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Users\xxxx\Downloads\Free Download Manager\iefdm2.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup O4 - HKCU\..\Run: [1&1 SMS-Manager] C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe" O4 - HKCU\..\Run: [Free Download Manager] D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe -autorun O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - Startup: FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe O4 - Global Startup: FRITZ!DSL Startcenter.lnk = ? O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = ? O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlall.htm O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlselected.htm O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dllink.htm O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html O8 - Extra context menu item: Videos mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlfvideo.htm O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://juniper.net/dana-cached/sc/JuniperSetupClient.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol- 8876480.dll O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files (x86)\Common Files\AVM\de_serv.exe (file missing) O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F- 2F227FCA9A08}\PIFSvc.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 12446 bytes |
![]() | #7 |
| ![]() Brauch Hilfe zu Google Redirect Virus Hallo, kann mir jemand bitte helfen Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:50:22, on 25.07.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16850) Boot mode: Normal Running processes: C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLACSD.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\alg.exe C:\Programme\Synaptics\SynTP\SynTPLpr.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\acer\epm\epm-dm.exe C:\Programme\Launch Manager\QtZgAcer.EXE C:\Programme\Real\RealPlayer\RealPlay.exe C:\Programme\QuickTime\qttask.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\Hama\Common\RaUI.exe C:\Programme\WISO\Sparbuch 2009\meinsparbuchheute.exe C:\Programme\acer\eRecovery\Monitor.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Dokumente und Einstellungen\DAS\Eigene Dateien\Downloads\HiJackThis.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot O4 - HKLM\..\Run: [LManager] C:\Programme\Launch Manager\QtZgAcer.EXE O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16 O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOKUME~1\DAS\protect.dll,_IWMPEvents@16 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: ChkDisk.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Hama Wireless LAN Utility.lnk = C:\Programme\Hama\Common\RaUI.exe O4 - Global Startup: WISO Mein Sparbuch heute.lnk = C:\Programme\WISO\Sparbuch 2009\meinsparbuchheute.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game02.zylom.com/activex/zylomgamesplayer.cab O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - http://as.photoprintit.de/ips-opdata...SUploader4.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\GEMEIN~1\aol\ACS\AOLACSD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O24 - Desktop Component 1: Aqua Real - 7db39a0d-580f-4be9-9195-8bfcd226f6c2 -- End of file - 7329 bytes Ich habe Highjackthis runtergeladen und das ist das Log. Es wäre nett, wenn mir jemand helfen könnte. Vielen Dank |
![]() | #8 |
/// Helfer-Team ![]() ![]() ![]() ![]() ![]() ![]() | ![]() Brauch Hilfe zu Google Redirect Virus @leverkusen Allgemeine Forenregeln: Neue Thread eröffnen! bitte nicht in die Threads anderer User hineinposten,sondern suche dir das richtige Unterforum für deine Frage aus! |
![]() |
Themen zu Brauch Hilfe zu Google Redirect Virus |
adobe, antivirus, bho, content.ie5, dsl, explorer, falsche seite, flash player, free download, google, google redirect virus, hijack, hijack.displayproperties, hkus\s-1-5-18, infizierte, infizierte datei, internet, internet explorer, internet security, intrusion prevention, launch, leitet, log-files, microsoft, object, plug-in, programdata, programme, registrierungsschlüssel, rundll, security, seiten, software, solution, super, symantec, system, syswow64, virus, vista, wmp |