|
"only the best" POPUPS Hallo ich bin mir nicht sicher ob hier alles richtig angekommen ist. daher nochmal mein Problem und den Schriftwechsel hierzu; Ich schrieb am 07.02.05: Only the best" POP-UPS -------------------------------------------------------------------------------- Hallo, habe mir glaube ich einen Virus eingefangen. ständig werden POP-UPs mit ONLY THE BEST geöffnet. Habe schon ein paar Virus-Programme drüber laufen lassen - haben auch was gefunden - trotzdem taucht das Problem immer wieder auf. Habe in den Beiträgen hier leider nicht so die richtige hilfe gefunden. Habe auch bereits schon escan im abgesicherten modus laufen lassen - ohne ergebnisse. kann mir jemand helfen?? hier das hijack log file: Logfile of HijackThis v1.99.0 Scan saved at 23:33:18, on 07.02.2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\atljw.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\sdktl.exe C:\Programme\AVPersonal\AVGNT.EXE C:\WINDOWS\System32\ctfmon.exe C:\Programme\T-COM\T-COM WLAN Manager T-Sinus 154data\Installer\WINXP\DTUSB11GMonitor.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\System32\wuauclt.exe C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\nvfah.dll/sp.html#12345 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {41BCB872-600B-7D3A-B545-A729E365FEE4} - C:\WINDOWS\appnw.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\ycomp5_ 5_7_0.dll O4 - HKLM\..\Run: [sdktl.exe] C:\WINDOWS\system32\sdktl.exe O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1101048074982 O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Network Security Service - Unknown - C:\WINDOWS\atljw.exe ---------------------------------------------------------------------------------------------------------- Darauf antwortete cronos am 08.02.05 Da fängt dein Problem schon an.Service Pack 2 ist aktuell.Weiterhin ist dein IE nicht aktuell.Aber dazu später. Scanne zunächst einmal folgende Dateien : C:\WINDOWS\system32\sdktl.exe C:\WINDOWS\appnw.dll C:\WINDOWS\atljw.exe hier Und berichte uns vom Ergebnis. __________________ Adora quod incendisti, incende quod adorasti ------------------------------------------------------------------------------------------ Das habe ich gemacht und das Ergebnis war folgendes: was muss ich jetzt tun?? für denn Scan appnw.dll ergab sich folgendes Ergebnis: Service load: 0% 100% File: appnw.dll Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) Packers detected: PE-CRYPT.SQR, UPX für das sdktl.exe folgender (was wird benötigt?): Service load: 0% 100% File: sdktl.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) Packers detected: None AntiVir TR/Dldr.Small.ajr (1.42 seconds taken) Avast Win32:Trojano-952 (3.08 seconds taken) AVG Antivirus Downloader.Small.20.AX (3.77 seconds taken) BitDefender No viruses found (1.57 seconds taken) ClamAV No viruses found (1.58 seconds taken) Dr.Web Trojan.DownLoader.1663 (1.82 seconds taken) F-Prot Antivirus W32/Downloader.ADN (0.73 seconds taken) Fortinet No viruses found (0.43 seconds taken) Kaspersky Anti-Virus Trojan-Downloader.Win32.Small.ajr (0.62 seconds taken) mks_vir Trojan.Downloader.Small.Ajr (0.21 seconds taken) NOD32 Win32/TrojanDownloader.Small.NBY (0.40 seconds taken) Norman Virus Control No viruses found (1.97 seconds taken) und für atljw.exe das hier: Service load: 0% 100% File: atljw.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) Packers detected: None AntiVir TR/StartPage.TJ (0.21 seconds taken) Avast Win32:Small-E (1.51 seconds taken) AVG Antivirus BackDoor.Small.6.AV (2.17 seconds taken) BitDefender No viruses found (1.17 seconds taken) ClamAV No viruses found (1.18 seconds taken) Dr.Web BackDoor.Inpru (1.67 seconds taken) F-Prot Antivirus No viruses found (0.28 seconds taken) Fortinet No viruses found (1.61 seconds taken) Kaspersky Anti-Virus No viruses found (0.57 seconds taken) mks_vir No viruses found (0.20 seconds taken) NOD32 Win32/Small.DC (0.36 seconds taken) Norman Virus Control No viruses found (0.48 seconds taken) Und was tu ich jetzt?? Gruß + Dank Mesdion |
@mesdion lade escan download anleitung überprüfe Deinen Rechner zunächst mit dem eScan: lade den eScan runter, erstelle dafür einen Ordner (=Verzeichnis) c:\bases, update den eScan online und führe ihn offline im abgesicherten Modus aus. Beachte, dass der eScan ab Version 4.5.1 gefundene Malware nicht löscht. Das wird von Hand auf Anweisung durch uns gemacht. Teile uns dann das Ergebnis des eScan mit: welche Viren wurden auf Deinem Rechner gefunden: "öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." (Zitat Cidre) chaosman |
Ich hab das selbe Problem habe auch schon mit Adware und so durchgeforstet. Hier heim Log: logfile of HijackThis v1.99.0 Scan saved at 16:08:01, on 18.3.2005 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\SYSTEM\E_S10IC2.EXE C:\WINDOWS\SYSTEM\IRMON.EXE C:\WINDOWS\SYSTEM\SISTRAY.EXE C:\WINDOWS\SYSTEM\KHOOKER.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\PROGRAMME\WINAMP\WINAMPA.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE C:\WINDOWS\RunDLL.exe C:\PROGRAMME\MSN MESSENGER\MSNMSGR.EXE C:\PROGRAMME\MICROSOFT REFERENCE\LEXIROM 4.0\QSHELF4G.EXE C:\PROGRAMME\MICROSOFT OFFICE\OFFICE\OSA.EXE C:\LOTUS\SMARTCTR\SMARTCTR.EXE C:\LOTUS\SMARTCTR\SUITEST.EXE C:\PROGRAMME\ULEAD SYSTEMS\ULEAD PHOTO EXPRESS 3.0 SE\CALCHECK.EXE C:\PROGRAMME\WEBDE\SMARTSURFER2.31\SMARTSURFER.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE D:\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\koyun.dll/sp.html#12345 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von freenet.de R3 - Default URLSearchHook is missing O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O2 - BHO: Class - {EF0124CB-C96F-7679-6100-05A3C16A52D7} - C:\WINDOWS\SDKOX.DLL (file missing) O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62" O4 - HKLM\..\Run: [IrMon] IrMon.exe O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\SYSTEM\SISTRAY.EXE O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\SYSTEM\khooker.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE /min O4 - HKLM\..\Run: [APPRE.EXE] C:\WINDOWS\SYSTEM\APPRE.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [CRJJ.EXE] C:\WINDOWS\CRJJ.EXE O4 - HKLM\..\RunServices: [APPKE.EXE] C:\WINDOWS\APPKE.EXE O4 - HKLM\..\RunServices: [IEKR.EXE] C:\WINDOWS\IEKR.EXE O4 - HKLM\..\RunServices: [SYSNG32.EXE] C:\WINDOWS\SYSTEM\SYSNG32.EXE O4 - HKLM\..\RunServices: [CRMQ32.EXE] C:\WINDOWS\CRMQ32.EXE O4 - HKLM\..\RunServices: [ATLBV.EXE] C:\WINDOWS\ATLBV.EXE O4 - HKLM\..\RunServices: [CRBN.EXE] C:\WINDOWS\SYSTEM\CRBN.EXE O4 - HKLM\..\RunServices: [WINTZ32.EXE] C:\WINDOWS\SYSTEM\WINTZ32.EXE O4 - HKLM\..\RunServices: [APIVZ32.EXE] C:\WINDOWS\APIVZ32.EXE O4 - HKLM\..\RunServices: [JAVAWF32.EXE] C:\WINDOWS\SYSTEM\JAVAWF32.EXE O4 - HKLM\..\RunServices: [WINRY.EXE] C:\WINDOWS\SYSTEM\WINRY.EXE O4 - HKLM\..\RunServices: [WINWG.EXE] C:\WINDOWS\WINWG.EXE O4 - HKLM\..\RunServices: [ATLNQ.EXE] C:\WINDOWS\ATLNQ.EXE O4 - HKLM\..\RunServices: [MFCXW32.EXE] C:\WINDOWS\SYSTEM\MFCXW32.EXE O4 - HKLM\..\RunServices: [WINNH32.EXE] C:\WINDOWS\WINNH32.EXE O4 - HKLM\..\RunServices: [CRUN32.EXE] C:\WINDOWS\SYSTEM\CRUN32.EXE O4 - HKLM\..\RunServices: [SYSNW.EXE] C:\WINDOWS\SYSTEM\SYSNW.EXE O4 - HKLM\..\RunServices: [SYSNY32.EXE] C:\WINDOWS\SYSTEM\SYSNY32.EXE O4 - HKLM\..\RunServices: [ATLCN32.EXE] C:\WINDOWS\ATLCN32.EXE O4 - HKLM\..\RunServices: [IEDM.EXE] C:\WINDOWS\IEDM.EXE O4 - HKLM\..\RunServices: [D3OV32.EXE] C:\WINDOWS\D3OV32.EXE O4 - HKLM\..\RunServices: [NTAH.EXE] C:\WINDOWS\NTAH.EXE O4 - HKLM\..\RunServices: [JAVACW32.EXE] C:\WINDOWS\JAVACW32.EXE O4 - HKLM\..\RunServices: [ATLXK.EXE] C:\WINDOWS\SYSTEM\ATLXK.EXE O4 - HKLM\..\RunServices: [NTRS.EXE] C:\WINDOWS\SYSTEM\NTRS.EXE O4 - HKLM\..\RunServices: [SDKWB32.EXE] C:\WINDOWS\SYSTEM\SDKWB32.EXE O4 - HKLM\..\RunServices: [ATLVD32.EXE] C:\WINDOWS\SYSTEM\ATLVD32.EXE O4 - HKLM\..\RunServices: [APPBO32.EXE] C:\WINDOWS\APPBO32.EXE O4 - HKLM\..\RunServices: [ADDFD32.EXE] C:\WINDOWS\ADDFD32.EXE O4 - HKLM\..\RunServices: [APPER32.EXE] C:\WINDOWS\SYSTEM\APPER32.EXE O4 - HKLM\..\RunServices: [MSJN32.EXE] C:\WINDOWS\SYSTEM\MSJN32.EXE O4 - HKLM\..\RunServices: [MFCJA.EXE] C:\WINDOWS\SYSTEM\MFCJA.EXE O4 - HKLM\..\RunServices: [MSIS32.EXE] C:\WINDOWS\SYSTEM\MSIS32.EXE O4 - HKLM\..\RunServices: [WINSH32.EXE] C:\WINDOWS\SYSTEM\WINSH32.EXE O4 - HKLM\..\RunServices: [WINPX32.EXE] C:\WINDOWS\SYSTEM\WINPX32.EXE O4 - HKLM\..\RunServices: [ADDXM.EXE] C:\WINDOWS\ADDXM.EXE O4 - HKLM\..\RunServices: [ATLVG.EXE] C:\WINDOWS\ATLVG.EXE O4 - HKLM\..\RunServices: [ATLAE.EXE] C:\WINDOWS\SYSTEM\ATLAE.EXE O4 - HKLM\..\RunServices: [JAVAKV.EXE] C:\WINDOWS\SYSTEM\JAVAKV.EXE O4 - HKLM\..\RunServices: [CRMK32.EXE] C:\WINDOWS\SYSTEM\CRMK32.EXE O4 - HKLM\..\RunServices: [WINIU32.EXE] C:\WINDOWS\WINIU32.EXE O4 - HKLM\..\RunServices: [SDKSB32.EXE] C:\WINDOWS\SDKSB32.EXE O4 - HKLM\..\RunServices: [NETNP32.EXE] C:\WINDOWS\SYSTEM\NETNP32.EXE O4 - HKLM\..\RunServices: [MFCKI32.EXE] C:\WINDOWS\MFCKI32.EXE O4 - HKLM\..\RunServices: [MSKO32.EXE] C:\WINDOWS\SYSTEM\MSKO32.EXE O4 - HKLM\..\RunServices: [JAVABH.EXE] C:\WINDOWS\JAVABH.EXE O4 - HKLM\..\RunServices: [APIXT.EXE] C:\WINDOWS\APIXT.EXE O4 - HKLM\..\RunServices: [D3GD32.EXE] C:\WINDOWS\SYSTEM\D3GD32.EXE O4 - HKLM\..\RunServices: [ATLLE32.EXE] C:\WINDOWS\SYSTEM\ATLLE32.EXE O4 - HKLM\..\RunServices: [IEWP.EXE] C:\WINDOWS\SYSTEM\IEWP.EXE O4 - HKLM\..\RunServices: [SYSKA.EXE] C:\WINDOWS\SYSTEM\SYSKA.EXE O4 - HKLM\..\RunServices: [APPDJ.EXE] C:\WINDOWS\SYSTEM\APPDJ.EXE O4 - HKLM\..\RunServices: [SYSYN32.EXE] C:\WINDOWS\SYSTEM\SYSYN32.EXE O4 - HKLM\..\RunServices: [JAVAHU32.EXE] C:\WINDOWS\SYSTEM\JAVAHU32.EXE O4 - HKLM\..\RunServices: [IPYO.EXE] C:\WINDOWS\SYSTEM\IPYO.EXE O4 - HKLM\..\RunServices: [IPUX.EXE] C:\WINDOWS\SYSTEM\IPUX.EXE O4 - HKLM\..\RunServices: [JAVACB.EXE] C:\WINDOWS\SYSTEM\JAVACB.EXE O4 - HKLM\..\RunServices: [IESS.EXE] C:\WINDOWS\IESS.EXE O4 - HKLM\..\RunServices: [MSVU32.EXE] C:\WINDOWS\MSVU32.EXE O4 - HKLM\..\RunServices: [SYSDS32.EXE] C:\WINDOWS\SYSDS32.EXE O4 - HKLM\..\RunServices: [MFCHU.EXE] C:\WINDOWS\SYSTEM\MFCHU.EXE O4 - HKLM\..\RunServices: [D3VJ32.EXE] C:\WINDOWS\D3VJ32.EXE O4 - HKLM\..\RunServices: [ADDTE32.EXE] C:\WINDOWS\SYSTEM\ADDTE32.EXE O4 - HKLM\..\RunServices: [MSNY.EXE] C:\WINDOWS\MSNY.EXE O4 - HKLM\..\RunServices: [APIKB32.EXE] C:\WINDOWS\APIKB32.EXE O4 - HKLM\..\RunServices: [IPVG32.EXE] C:\WINDOWS\IPVG32.EXE O4 - HKLM\..\RunServices: [NTVE32.EXE] C:\WINDOWS\NTVE32.EXE O4 - HKLM\..\RunServices: [JAVAZP32.EXE] C:\WINDOWS\JAVAZP32.EXE O4 - HKLM\..\RunServices: [APPXW.EXE] C:\WINDOWS\SYSTEM\APPXW.EXE O4 - HKLM\..\RunServices: [NTYY.EXE] C:\WINDOWS\SYSTEM\NTYY.EXE O4 - HKLM\..\RunServices: [CREG.EXE] C:\WINDOWS\CREG.EXE O4 - HKLM\..\RunServices: [CROF.EXE] C:\WINDOWS\CROF.EXE O4 - HKLM\..\RunServices: [MSQU.EXE] C:\WINDOWS\SYSTEM\MSQU.EXE O4 - HKLM\..\RunServices: [APPDA32.EXE] C:\WINDOWS\APPDA32.EXE O4 - HKLM\..\RunServices: [NTXN32.EXE] C:\WINDOWS\NTXN32.EXE O4 - HKLM\..\RunServices: [NTID.EXE] C:\WINDOWS\SYSTEM\NTID.EXE O4 - HKLM\..\RunServices: [MSFG.EXE] C:\WINDOWS\MSFG.EXE O4 - HKLM\..\RunServices: [SDKUQ.EXE] C:\WINDOWS\SYSTEM\SDKUQ.EXE O4 - HKLM\..\RunServices: [ADDFQ.EXE] C:\WINDOWS\SYSTEM\ADDFQ.EXE O4 - HKLM\..\RunServices: [ATLSU.EXE] C:\WINDOWS\SYSTEM\ATLSU.EXE O4 - HKLM\..\RunServices: [CRAE.EXE] C:\WINDOWS\SYSTEM\CRAE.EXE O4 - HKLM\..\RunServices: [IEIS.EXE] C:\WINDOWS\IEIS.EXE O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "c:\Programme\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR O4 - HKCU\..\Run: [MsnMsgr] "c:\Programme\MSN Messenger\MsnMsgr.Exe" /background O4 - Startup: QShelf4g.lnk = C:\Programme\Microsoft Reference\LexiROM 4.0\QShelf4g.exe O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE O4 - Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe O4 - Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe O4 - Startup: Ulead Photo Express SE Calendar Checker.lnk = C:\Programme\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe O4 - Startup: SmartSurfer.lnk = C:\Programme\WEBDE\SmartSurfer2.31\SmartSurfer.exe O8 - Extra context menu item: &Google Search - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html O8 - Extra context menu item: Ähnliche Seiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html O8 - Extra context menu item: Verweisseiten - res://C:\PROGRAMME\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html O14 - IERESET.INF: START_PAGE_URL=http://www.freenet.de O15 - Trusted Zone: *.05p.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.my-internet.info O15 - Trusted Zone: *.scoobidoo.com O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.static.topconverting.com O15 - Trusted Zone: *.05p.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.scoobidoo.com (HKLM) O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O15 - Trusted Zone: *.static.topconverting.com (HKLM) O15 - Trusted IP range: 206.161.125.149 O15 - Trusted IP range: 206.161.125.149 (HKLM) O16 - DPF: Win32 Classes - file://c:\windows\Java\classes\win32ie4.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx |
Hallo Runkelz, Dein System ist völlig verseucht. Empfohlene Anleitung zur Neuinstallation http://www.trojaner-board.de/showthread.php?t=12154 Thema Datensicherung: http://www.trojaner-board.de/showpos...8&postcount=11 dartus |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 19:18 Uhr. |
Copyright ©2000-2025, Trojaner-Board