![]() |
TR/Qhost, TR/Click.spywad, TR/Dldr.small.buy Leider bekomme ich diese og Trojaner nicht weg, hab die wohl üblichen Tools verwendet und hijackthis mit der online-Hilfe. Antivir erkennt die Viecher aber kann damit nichts anstellen. Ob mir hier einer von Euch helfen kann. BItte, Bitte Hier der HJT Log im abgesicherten Modus: Logfile of HijackThis v1.99.1 Scan saved at 22:15:48, on 19.02.2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\Programme\WinRAR\WinRAR.exe C:\DOKUME~1\lk\LOKALE~1\Temp\Rar$EX00.031\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = : F2 - REG:system.ini: Shell=explorer.exe "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\ibm00009.exe" O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {EA32FB3B-21C9-42cc-B8EF-01A9B28EDB0D} - C:\WINDOWS\system32\ssqpn.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [UFD Monitor] C:\Programme\TwinMOS\Mobile Disk V3.0\MobMon.exe O4 - HKLM\..\Run: [UFD Utility] C:\Programme\TwinMOS\Mobile Disk V3.0\UsbTD.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Programme\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programme\Gemeinsame Dateien\Nokia\Tools\NclTray.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [MS Unix Binary] win32ttb.exe O4 - HKLM\..\Run: [Dynamic Dns Binary] cmd16.exe O4 - HKLM\..\Run: [Windows Registry] winhost.exe O4 - HKLM\..\Run: [Microsoft Opeions] IEXwe.exe O4 - HKLM\..\Run: [MS Auto-IPSec Protection] MSASP32.exe O4 - HKLM\..\Run: [bnnusdh] c:\windows\system32\zegbff.exe r O4 - HKLM\..\Run: [AVMBlueClient] C:\Programme\avmclient\bluefritz.exe O4 - HKLM\..\Run: [AVMBLUEOBEX] C:\Programme\avmclient\AvmObex.exe -pushclient -ftpclient O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MS Windows System Alert] MSWSA32.exe O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Programme\SigmaTel\C-Major Audio\stacmon.exe O4 - HKLM\..\Run: [IpNetwork] C:\Programme\Network\ipnetwork.exe O4 - HKLM\..\RunServices: [MS Unix Binary] win32ttb.exe O4 - HKLM\..\RunServices: [Dynamic Dns Binary] cmd16.exe O4 - HKLM\..\RunServices: [Windows Registry] winhost.exe O4 - HKLM\..\RunServices: [Microsoft Opeions] IEXwe.exe O4 - HKLM\..\RunServices: [MS Auto-IPSec Protection] MSASP32.exe O4 - HKLM\..\RunServices: [MS Windows System Alert] MSWSA32.exe O4 - HKCU\..\Run: [MS Unix Binary] win32ttb.exe O4 - HKCU\..\Run: [Dynamic Dns Binary] cmd16.exe O4 - HKCU\..\Run: [Windows Registry] winhost.exe O4 - HKCU\..\Run: [Microsoft Opeions] IEXwe.exe O4 - HKCU\..\Run: [MS Auto-IPSec Protection] MSASP32.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MS Windows System Alert] MSWSA32.exe O4 - HKCU\..\RunServices: [Microsoft Opeions] IEXwe.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE O4 - Global Startup: Photo Loader resident.lnk = C:\Programme\CASIO\Photo Loader\Plauto.exe O4 - Global Startup: PowerPanel.lnk = ? O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\INETREPL.DLL O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/ O15 - Trusted Zone: *.sony-europe.com O15 - Trusted Zone: *.sonystyle-europe.com O15 - Trusted Zone: *.vaio-link.com O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{5BBD899B-2916-492C-94C2-297553AAF725}: NameServer = 192.168.120.252,192.168.120.253 O20 - Winlogon Notify: ssldr - C:\WINDOWS\SYSTEM32\ssldr32.dll O20 - Winlogon Notify: ssqpn - C:\WINDOWS\SYSTEM32\ssqpn.dll O20 - Winlogon Notify: wancp - C:\WINDOWS\SYSTEM32\wancp.dll O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AVM BT Connection Service - AVM Berlin - C:\Programme\avmclient\avmbtservice.exe O23 - Service: AVM BT OBEX Service (AvmObexService) - AVM Berlin - C:\Programme\avmclient\AvmObexService.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Remote Procedure Call (RPC) Client (RpcClient) - Unknown owner - C:\WINDOWS\System32\rpcclient.exe (file missing) Muß ich vielleicht auch noch was von Hand löschen ? Vielen Dank |
Du hast so ziemlich alles, was man sich an Malware einfangen kann auf dem PC. Du musst das System neu aufsetzen. |
Alle Zeitangaben in WEZ +1. Es ist jetzt 21:07 Uhr. |
Copyright ©2000-2025, Trojaner-Board