| |
| |||||||
Log-Analyse und Auswertung: IE Explorer öffnet von alleine SeitenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.12.2009, 14:54
| #1 |
| |  IE Explorer öffnet von alleine Seiten hallo bin neu hier im forum, ich hab ein problem mit meinem notebook. wenn ich im internetexplorer irgendwelche seiten öffne, werden automatisch irendwelche seiten in einem neuen fenster geöffnet. hab mal eine eine logfile mit HijackThis gemact: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:27:15, on 25.12.2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18865) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\lg_swupdate\GiljabiStart.exe C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\InstantBurn\Win2K\IBurn.exe C:\Windows\System32\rundll32.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Users\***\AppData\Local\ttahelk.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Arcor\Arcor Wlan-Monitor 1.0\ArcorWlanUtility.exe C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://de.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll O3 - Toolbar: iMesh MediaBar - {B7D3E479-CC68-42B5-A338-938ECE35F419} - C:\Program Files\iMesh Applications\iMesh MediaBar\iMeshMediaBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll O3 - Toolbar: Veoh Video Compass - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [InstantBurn] C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [ttahelk] "c:\users\***\appdata\local\ttahelk.exe" ttahelk O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Arcor Wlan-Monitor 1.0.lnk = C:\Program Files\Arcor\Arcor Wlan-Monitor 1.0\ArcorWlanUtility.exe O4 - Global Startup: Ulead Photo Express SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O13 - Gopher Prefix: O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://www.internet-sparbuch.de/wiso/aspx/wisoappl/Download/icaweb.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUpldde-de.cab O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://static.pe.meinvz.net/photouploader/ImageUploader5.cab?nocache=1226093471 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe O23 - Service: Google Update Service (gupdate1c9dd678d50b9fd) (gupdate1c9dd678d50b9fd) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe O23 - Service: Evil Driver Daemon (NishService) - Unknown owner - C:\Program Files\LG Software\System Control Manager\edd.exe O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 11849 bytes kann da jemand weiterhelfen? danke |
|
25.12.2009, 17:45
| #2 |
| | IE Explorer öffnet von alleine Seiten Ja hallo ich habe genau das selbe Problem, ich benutze den firefox browser aber der internet explorer öffnet nach einer weile einfach mal so eine seite.
__________________hier sind auch meine ergebnisse des checks: <br><br><br>Logfile of Trend Micro HijackThis v2.0.3 (BETA)<br>Scan saved at 17:28:31, on 25.12.2009<br>Platform: Windows Vista SP2 (WinNT 6.00.1906)<br>MSIE: Internet Explorer v8.00 (8.00.6001.18865)<br>Boot mode: Normal<br><br>Running processes:<br>C:\PROGRAM FILES\PANDA SECURITY\PANDA GLOBAL PROTECTION 2010\WebProxy.exe<br>C:\Windows\system32\taskeng.exe<br>C:\Windows\system32\Dwm.exe<br>C:\Windows\Explorer.EXE<br>C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe<br>C:\Windows\RtHDVCpl.exe<br>C:\Program Files\Keyboard Driver\OEMDriver.exe<br>C:\Program Files\Revoltec\FightMouse\Panel.exe<br>C:\Program Files\SweetIM\Messenger\SweetIM.exe<br>C:\Program Files\Panda Security\Panda Global Protection 2010\ApVxdWin.exe<br>C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe<br>C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe<br>C:\Program Files\Windows Media Player\wmpnscfg.exe<br>C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe<br>C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe<br>C:\Program Files\Panda Security\Panda Global Protection 2010\PavBckPT.exe<br>C:\Program Files\Mozilla Firefox\firefox.exe<br>C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe<br>C:\Windows\system32\DllHost.exe<br><br>R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896<br>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/<br>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157<br>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896<br>R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896<br>R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157<br>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = <br>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = <br>R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = <br>R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll<br>O1 - Hosts: ::1 localhost<br>O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll<br>O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll<br>O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll<br>O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL<br>O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL<br>O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll<br>O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide<br>O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe<br>O4 - HKLM\..\Run: [Skytel] Skytel.exe<br>O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun<br>O4 - HKLM\..\Run: [KBDriver] C:\Program Files\Keyboard Driver\OEMDriver.exe<br>O4 - HKLM\..\Run: [FightMouse Advanced] "C:\Program Files\Revoltec\FightMouse\Panel.exe"<br>O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe<br>O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Global Protection 2010\APVXDWIN.EXE" /s<br>O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Global Protection 2010\Inicio.exe"<br>O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"<br>O4 - HKCU\..\Run: [J8RPLTROBQ] C:\Users\Michael\AppData\Local\Temp\c.exe<br>O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe<br>O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000<br>O9 - Extra button: HP Sammelmappe - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll<br>O9 - Extra button: HP Intelligente Auswahl - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll<br>O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe<br>O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe<br>O13 - Gopher Prefix: <br>O20 - AppInit_DLLs: <br>O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll<br>O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe<br>O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe<br>O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe<br>O23 - Service: Panda Software Controller - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2010\PsCtrls.exe<br>O23 - Service: Panda Function Service (PAVFNSVR) - Unknown owner - C:\Program Files\Panda Security\Panda Global Protection 2010\PavFnSvr.exe<br>O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe<br>O23 - Service: Panda On-Access Anti-Malware Service (PAVSRV) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2010\pavsrvx86.exe<br>O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe<br>O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe<br>O23 - Service: Panda Host Service (PSHost) - Unknown owner - c:\program files\panda security\panda global protection 2010\firewall\PSHOST.EXE<br>O23 - Service: Panda IManager Service (PSIMSVC) - Panda Security S.L. - C:\Program Files\Panda Security\Panda Global Protection 2010\PsImSvc.exe<br>O23 - Service: Panda PSK service (PskSvcRetail) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2010\PskSvc.exe<br>O23 - Service: Panda TPSrv (TPSrv) - Panda Security, S.L. - C:\Program Files\Panda Security\Panda Global Protection 2010\TPSrv.exe<br>O23 - Service: @C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe<br>O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe<br><br>--<br>End of file - 6951 bytes<br><br><br> ich hoffe sie können uns helfen. MFG ATIRadeon PS: Frohe Weihnachten  |
|
25.12.2009, 18:08
| #3 |
  | IE Explorer öffnet von alleine Seiten Hi,
__________________AtiRadeon bitte einen eigenen, lesbaren Thread eröffnen! Shoppingreport... Bitte unten im Script die drei * (fett markiert) gegen die richtige Bezeichnung austauschen, sonst funktioniert das Löschen nicht! Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code:
ATTFilter c:\users\***\appdata\local\ttahelk.exe
Also: Anleitung Avenger (by swandog46) 1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:  2.) Das Programm so einstellen wie es auf dem Bild zu sehen ist. Kopiere nun folgenden Text in das weiße Feld: (bei -> "input script here") Code:
ATTFilter Files to delete:
C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
c:\users\***\appdata\local\ttahelk.exe
Folders to delete:
C:\Program Files\ShoppingReport
4.) Um den Avenger zu starten klicke auf -> Execute Dann bestätigen mit "Yes" das der Rechner neu startet! 5.) Nachdem das System neu gestartet ist, findest du hier einen Report vom Avenger -> C:\avenger.txt Öffne die Datei mit dem Editor und kopiere den gesamten Text in deinen Beitrag hier am Trojaner-Board. Hijackthis, fixen: öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Beim fixen müssen alle Programme geschlossen sein! Code:
ATTFilter
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
O4 - HKCU\..\Run: [ttahelk] "c:\users\***\appdata\local\ttahelk.exe" ttahelk
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll
R3 - URLSearchHook: (no name) - - (no file)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Fullscan und alles bereinigen lassen! Log posten. RSIT Random's System Information Tool (RSIT) von random/random liest Systemdetails aus und erstellt ein aussagekräftiges Logfile. * Lade Random's System Information Tool (RSIT) herunter (http://filepony.de/download-rsit/) * speichere es auf Deinem Desktop. * Starte mit Doppelklick die RSIT.exe. * Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren. * Wenn Du HijackThis nicht installiert hast, wird RSIT das für Dich herunterladen und installieren. * In dem Fall bitte auch die Nutzungsbedingungen von Trend Micro (http://de.trendmicro.com/de/home) für HJT akzeptieren "I accept". * Wenn Deine Firewall fragt, bitte RSIT erlauben, ins Netz zu gehen. * Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage. * Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet. * Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread. Gmer: http://www.trojaner-board.de/74908-a...t-scanner.html Den Downloadlink findest Du links oben (http://www.gmer.net/#files), dort dann auf den Button "Download EXE", dabei wird ein zufälliger Name generiert (den und den Pfad wo Du sie gespeichert hast bitte merken). Starte GMER und schaue, ob es schon was meldet. Macht es das, bitte alle Fragen mit "nein" beantworten, auf den Reiter "rootkit" gehen, wiederum die Frage mit "nein" beantworten und mit Hilfe von copy den Bericht in den Thread einfügen. Meldet es so nichts, gehe auf den Reiter Rootkit und mache einen Scan. Ist dieser beendet, wähle Copy und füge den Bericht ein. Chris Ps.: Was mache ich hier eigentlich, ich bin im URLAUB... Arrrggghhh...
__________________ |
|
25.12.2009, 23:12
| #4 |
| | IE Explorer öffnet von alleine Seiten danke, dass du trotz deines urlaubs rasch antwortest hab die datei bei virustotal hochgeladen, hier das ergebnis: Antivirus Version letzte aktualisierung Ergebnis a-squared 4.5.0.43 2009.12.25 Trojan.Hrup!IK AhnLab-V3 5.0.0.2 2009.12.25 - AntiVir 7.9.1.122 2009.12.25 - Antiy-AVL 2.0.3.7 2009.12.25 - Authentium 5.2.0.5 2009.12.25 - Avast 4.8.1351.0 2009.12.25 - AVG 8.5.0.430 2009.12.25 - BitDefender 7.2 2009.12.25 Gen:Adware.Heur.zqW@FAf1iTiid CAT-QuickHeal 10.00 2009.12.24 - ClamAV 0.94.1 2009.12.25 - Comodo 3367 2009.12.25 - DrWeb 5.0.1.12222 2009.12.25 - eSafe 7.0.17.0 2009.12.24 - eTrust-Vet 35.1.7198 2009.12.25 - F-Prot 4.5.1.85 2009.12.25 - F-Secure 9.0.15370.0 2009.12.25 Gen:Adware.Heur.zqW@FAf1iTiid Fortinet 4.0.14.0 2009.12.25 - GData 19 2009.12.25 Gen:Adware.Heur.zqW@FAf1iTiid Ikarus T3.1.1.79.0 2009.12.25 Trojan.Hrup Jiangmin 13.0.900 2009.12.25 - K7AntiVirus 7.10.929 2009.12.24 - Kaspersky 7.0.0.125 2009.12.25 - McAfee 5842 2009.12.24 - McAfee+Artemis 5842 2009.12.24 - McAfee-GW-Edition 6.8.5 2009.12.25 - Microsoft 1.5302 2009.12.25 Trojan:Win32/Skintrim.C NOD32 4716 2009.12.25 a variant of Win32/Skintrim.CZ Norman 6.04.03 2009.12.24 - nProtect 2009.1.8.0 2009.12.24 - Panda 10.0.2.2 2009.12.15 - PCTools 7.0.3.5 2009.12.25 - Prevx 3.0 2009.12.25 - Rising 22.27.04.04 2009.12.25 - Sophos 4.49.0 2009.12.25 Mal/Hrup-A Sunbelt 3.2.1858.2 2009.12.25 - Symantec 1.4.4.12 2009.12.25 - TheHacker 6.5.0.3.111 2009.12.25 - TrendMicro 9.120.0.1004 2009.12.25 - VBA32 3.12.12.0 2009.12.25 - ViRobot 2009.12.24.2107 2009.12.24 - VirusBuster 5.0.21.0 2009.12.25 - weitere Informationen File size: 413696 bytes MD5...: beb1f842395bae9b8b48d6b0e318f6f8 SHA1..: 440b212f78b817a619a015259982d4b065f545b8 SHA256: 44ecced27cab7aab393fa4dd416626f65b14a6d21a781ef0e6b69aa4af283469 ssdeep: 6144:xkCHmwgYNL/5BkhzxZ7ctnImD38gvw43HIwrOCkoGHgUi+lZKhr6BvXRPTQ Xz:BHbgY8wGmD8Qw0ERocg63Xvh PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x2c40 timedatestamp.....: 0x477589a2 (Fri Dec 28 23:41:22 2007) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xc9dc 0xd000 6.59 ffd70b0e1c17bf819ef613783971d560 .rdata 0xe000 0x4f09a 0x50000 7.19 eedfc03b0ca968c0bdaa96074e22a0cf .data 0x5e000 0x6618 0x6000 4.90 799041902907990e9ce809934c848d00 .rsrc 0x65000 0x488 0x1000 1.14 af5572d3f0cae7fe77fb404081267504 ( 5 imports ) > ADVAPI32.dll: RegSetValueExA, RegQueryValueExA, RegCloseKey, RegDeleteValueA > GDI32.dll: DeleteObject, GetDeviceCaps > ole32.dll: CoCreateInstance, CoTaskMemAlloc, CoInitialize, CoUninitialize > USER32.dll: SetForegroundWindow, MoveWindow, PostQuitMessage, SetWindowPos, IsWindow, GetDC, DrawTextA, DestroyWindow, GetParent, UpdateWindow, ShowWindow, EnableWindow, GetWindow, LoadStringA, IsIconic, RegisterClassA, FillRect, EndPaint, SetFocus, PeekMessageA, BeginPaint, KillTimer, DefWindowProcA, GetSystemMetrics, GetWindowRect, SetCapture, SetWindowLongA, SetWindowTextA, CheckMenuItem, ScreenToClient, EndDialog, SetDlgItemTextA, MessageBoxA, SendMessageA, GetClientRect, GetFocus > KERNEL32.dll: SetEnvironmentVariableA, GetLocaleInfoW, GetTimeZoneInformation, GetUserDefaultLCID, EnumSystemLocalesA, IsValidCodePage, IsValidLocale, SetConsoleCtrlHandler, IsBadWritePtr, FatalAppExitA, RtlUnwind, GetCurrentThread, GetStdHandle, GetConsoleOutputCP, WaitForSingleObject, HeapDestroy, GetFileAttributesW, FreeEnvironmentStringsA, DeleteCriticalSection, GetCurrentProcess, GetCurrentDirectoryA, GetLocaleInfoA, LocalAlloc, SetErrorMode, FreeEnvironmentStringsW, GetCPInfo, GetStringTypeA, InterlockedExchange, WriteFile, GetSystemTimeAsFileTime, HeapReAlloc, GetStringTypeW, SetFileAttributesA, FreeLibrary, LocalFree, InitializeCriticalSection, LoadResource, FindClose, InterlockedDecrement, FormatMessageA, OutputDebugStringA, SetLastError, VirtualAlloc, VirtualFree, HeapCreate, GetEnvironmentStrings, SetStdHandle, GetModuleHandleW, GlobalLock, GetACP, lstrcpynA, CloseHandle, FindFirstFileA, ReadFile, SetFilePointer, TlsFree, MapViewOfFile, RaiseException, InterlockedCompareExchange, GetCommandLineA, HeapSize, WideCharToMultiByte, GetCommandLineW, LockResource, GetCurrentProcessId, SizeofResource, lstrlenW, GetEnvironmentStringsW, LCMapStringA, FindResourceW, GetConsoleCP, GlobalFree, lstrlenA, UnmapViewOfFile, LCMapStringW, GetLastError, LeaveCriticalSection, HeapAlloc, CreateFileA, TlsSetValue, GetFileType, CreateFileW, Sleep, RemoveDirectoryA, WaitForMultipleObjects, FindNextFileA, CompareStringA, GetCurrentThreadId, FindNextFileW, CompareStringW, GetProcessHeap, GetProcAddress, DeleteFileW, SetEvent, DeleteFileA, GetFileSize, GetStartupInfoA, LoadLibraryA, GetVersionExA, TlsAlloc, GetTickCount, QueryPerformanceCounter, GetOEMCP, SetHandleCount, EnterCriticalSection, HeapFree, WriteConsoleW, InterlockedIncrement, GetVersion, SetEndOfFile, GlobalAlloc, TerminateProcess, GetSystemDirectoryA, SetUnhandledExceptionFilter, CreateThread, GetModuleHandleA, CreateMutexA, MultiByteToWideChar, TlsGetValue, UnhandledExceptionFilter, LoadLibraryExA, GetModuleFileNameA, FlushFileBuffers, ExitProcess, IsDebuggerPresent, GetModuleFileNameW, GetEnvironmentVariableA ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - trid..: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned hier das ergebnis vom avenger: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows Vista ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\Program Files\ShoppingReport\Bin\2.6.58\ShoppingReport.dll" deleted successfully. File "c:\users\***\appdata\local\ttahelk.exe" deleted successfully. Folder "C:\Program Files\ShoppingReport" deleted successfully. Completed script processing. ******************* Finished! Terminate. Geändert von othello (25.12.2009 um 23:23 Uhr) |
|
26.12.2009, 09:24
| #5 |
| | IE Explorer öffnet von alleine Seiten Hi, bitte noch die restlichen Logs (MAM, RSIT und Gmer) posten. chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
26.12.2009, 13:15
| #6 |
| | IE Explorer öffnet von alleine Seiten Malwarebytes' Anti-Malware 1.42 Datenbank Version: 3289 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.18865 26.12.2009 13:11:37 mbam-log-2009-12-26 (13-11-37).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 233307 Laufzeit: 58 minute(s), 0 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 52 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 1 Infizierte Dateien: 8 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\coresrv.lfgax (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.lfgax.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostie.bho (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostie.bho.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.hbax (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.hbax.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.hbinfoband (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.hbinfoband.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.iebutton (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.iebutton.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.iebuttona (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.iebuttona.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.rprtctrl (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\shoppingreport.rprtctrl.1 (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{8ad9ad05-36be-4e40-ba62-5422eb0d02fb} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{aebf09e2-0c15-43c8-99bf-928c645d98a0} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d8560ac2-21b5-4c1a-bdd4-bd12bc83b082} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{20ea9658-6bc3-4599-a87d-6371fe9295fc} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a16ad1e9-f69a-45af-9462-b1c286708842} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c9ccbb35-d123-4a31-affc-9b2933132116} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{cdca70d8-c6a6-49ee-9bed-7429d6c477a2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d136987f-e1c4-4ccc-a220-893df03ec5df} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e343edfc-1e6c-4cb5-aa29-e9c922641c80} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a7cddcdc-beeb-4685-a062-978f5e07ceee} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.coreservices (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\coresrv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbmain.commband.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hbr.hbmain.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.mailanim (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.mailanim.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.webmailsend (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\hostol.webmailsend.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\srv.coreservices (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\srv.coreservices.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.htmlmenuui (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.htmlmenuui.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.toolbarctl (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\toolbar.toolbarctl.1 (Adware.Zango) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\fcn (Rogue.Residue) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\ShoppingReport (Adware.ShopperReports) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b7d3e479-cc68-42b5-a338-938ece35f419} (Adware.Softomate) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\ProgramData\2ACA5CC3-0F83-453D-A079-1076FE1A8B65 (Adware.Seekmo) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Avenger\ShoppingReport.dll (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmp1F05.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmp23A6.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmp6FE2.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmpA90B.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmpB9EB.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\AppData\Local\Temp\tmp9B16.tmp.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\***\Downloads\setup.exe (Adware.Hotbar) -> Quarantined and deleted successfully. die anderen logs folgen |
|
| Themen zu IE Explorer öffnet von alleine Seiten |
| adobe, agere systems, ashampoo uninstaller, avp, avp.exe, bho, compare, defender, explorer, firefox, gupdate, helper, hijack, hijackthis, ie explorer, internet explorer, internet security, internet security 2010, kaspersky, logfile, mozilla, object, picasa, plug-in, problem, rundll, security, software, system, tastatur, virtuelle tastatur, vista, windows, öffnet |
Linear-Darstellung
