![]() |
|
Log-Analyse und Auswertung: hijackthis log (bitte um hilfe)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() hijackthis log (bitte um hilfe) so werde nun meinen log posten, da ich wirklich null ahnung von der sache habe, ich bedanke mich schon mal im vorraus!!! Logfile of HijackThis v1.98.2 Scan saved at 13:12:21, on 26.10.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Keymaestro\Multimedia Keyboard\nhksrv.exe C:\Programme\Norton AntiVirus\navapsvc.exe C:\Programme\Norton Internet Security\NISUM.EXE C:\WINDOWS\System32\svchost.exe C:\Programme\Norton Internet Security\SymProxySvc.exe C:\Programme\Norton Internet Security\NISSERV.EXE C:\WINDOWS\System32\svchosting.exe C:\WINDOWS\System32\RunDll32.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programme\Keymaestro\Multimedia Keyboard\MMKeybd.exe C:\programme\powerstrip\pstrip.exe C:\PROGRA~1\NORTON~1\navapw32.exe C:\Programme\Norton Internet Security\IAMAPP.EXE C:\WINDOWS\szchost.exe C:\Programme\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\System32\crsss.exe C:\WINDOWS\System32\winmplayer.exe C:\WINDOWS\System32\msndp.exe C:\Programme\Keymaestro\Multimedia Keyboard\TrayMon.exe C:\Programme\Keymaestro\Onscreen Display\OSD.exe C:\Dokumente und Einstellungen\Tim Hering\Anwendungsdaten\trsl.exe C:\Programme\Norton Internet Security\ATRACK.EXE C:\PROGRA~1\MOZILL~1\firefox.exe C:\Dokumente und Einstellungen\Tim Hering\Desktop\HijackThis-1.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://search-all.net/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:search R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://search-all.net/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {3BF2D9E1-3BF4-4624-9805-91A3981482CA} - C:\WINDOWS\System32\bkghfb.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - (no file) O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [o2cd] C:\Programme\O2Micro\AudioDJ\o2cd.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programme\Keymaestro\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [PowerStrip] c:\programme\powerstrip\pstrip.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe O4 - HKLM\..\Run: [iamapp] C:\Programme\Norton Internet Security\IAMAPP.EXE O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [Zone system] C:\WINDOWS\szchost.exe O4 - HKLM\..\Run: [syschk] syschk.exe /fastcheck O4 - HKLM\..\Run: [Win32 USB2 Driver] svchosting.exe O4 - HKLM\..\Run: [Windows media service] crsss.exe O4 - HKLM\..\Run: [Microsoft media services] winmplayer.exe O4 - HKLM\..\Run: [Msn Patch] msndp.exe O4 - HKLM\..\RunServices: [Win32 USB2 Driver] svchosting.exe O4 - HKLM\..\RunServices: [Windows media service] crsss.exe O4 - HKLM\..\RunServices: [Microsoft media services] winmplayer.exe O4 - HKLM\..\RunServices: [Msn Patch] msndp.exe O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] svchosting.exe O4 - HKCU\..\Run: [Steam] "c:\programme\steamnew\steam.exe" -silent O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [Oece] C:\Dokumente und Einstellungen\Tim Hering\Anwendungsdaten\trsl.exe O4 - HKCU\..\Run: [syschk] syschk.exe /fastcheck O4 - HKCU\..\Run: [Win32 USB2 Driver] svchosting.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] svchosting.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Corel Network monitor worker - {D35CD05D-3F89-47A9-A3FA-2D0A39D21355} - (no file) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {D35CD05D-3F89-47A9-A3FA-2D0A39D21355} - (no file) O9 - Extra button: Corel Network monitor worker - {D35CD05D-3F89-47A9-A3FA-2D0A39D21355} - (no file) (HKCU) O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {D35CD05D-3F89-47A9-A3FA-2D0A39D21355} - (no file) (HKCU) O12 - Plugin for .pdf: C:\Programme\Internet Explorer\PLUGINS\nppdf32.dll O13 - DefaultPrefix: O13 - WWW Prefix: O13 - Home Prefix: http://www.heretofind.com/show.php?id=17&q= O13 - Mosaic Prefix: http://www.heretofind.com/show.php?id=17&q= O13 - Gopher Prefix: http://www.heretofind.com/show.php?id=17&q= O14 - IERESET.INF: START_PAGE_URL=http://www.acer.com O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.flingstone.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.searchbarcash.com O15 - Trusted Zone: *.searchmiracle.com O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/587/online.chm::/on-line.exe O16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q330995.exe O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - file://c:\x.cab O16 - DPF: {BD11A280-2E73-11CF-B6CF-00AA00A74DAE} - file://C:\Info_sex4.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{06D3AFF4-D781-41A0-B5A5-C23F3065CC66}: NameServer = 192.168.122.253,192.168.122.252 O17 - HKLM\System\CCS\Services\Tcpip\..\{FD0FEE42-4847-40F1-B79C-D0A7F8513A75}: NameServer = 212.7.148.65 212.7.148.97 O17 - HKLM\System\CS1\Services\Tcpip\..\{06D3AFF4-D781-41A0-B5A5-C23F3065CC66}: NameServer = 192.168.122.253,192.168.122.252 O18 - Filter: text/html - {3ED5F7CA-4587-4039-B1D6-19F5E6C6FA1D} - C:\WINDOWS\System32\bkghfb.dll O18 - Filter: text/plain - {3ED5F7CA-4587-4039-B1D6-19F5E6C6FA1D} - C:\WINDOWS\System32\bkghfb.dll ihr müsst mir nur sagen was ich machen soll, und wie ich mein system in zukunft schützen kann... |
Themen zu hijackthis log (bitte um hilfe) |
.inf, .pdf, adobe, antivirus, bho, bitte um hilfe, desktop, dll, einstellungen, explorer, hijack, hijackthis, hijackthis log, hilfe, internet, internet explorer, internet security, log, microsoft, monitor, programme, rundll, security, software, symantec, system, tcpip, urlsearchhook, usb, windows, windows xp |