|
Malware, Laggs, ... Bitte checken hallo Ich bin's mal wieder :) Ich scanne sehr unregelmaessig, letztens aber erst scannen lassen, mit Avast; hmm... 4776 infizierte Dateien :heulen: (lassen sich nicht per Avast loeschen, geschweige denn reparieren. Seit vorgestern kommt beim Starten von Opera eine Meldung, er habe Malware oder sowas gefunden, und ich kann nicht starten, erst wenn ich auf "no action" klicke. Ich kann jegliche Seiten von Google nicht mehr benuetzen, wie ich zudem festgestellt habe, auch keine andere Suchmaschine, wie Altavista, Yahoo etc. Wikipedia und andere Seiten gehen ohne Probleme. Vorher mal CD eingeschoben und "repariert", weiss nicht ob es was gebracht hat. Wollte eigentlich rebooten, nur stand da kein "Drueck D zum Loeschen". Und nun ein Problem mehr. Das allgemeine Benutzen des CPUs ist langsamer geworden, es laggt und will manchmal nicht... Nun hoffe ich, ihr koennt mir Rat geben. Hier der HiJackThis-Log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:50:34, on 19.07.2008 Platform: Windows XP SP1 (WinNT 5.01.2600) (Hatte mal SP2, muss ich wohl wieder neu aufsetzen.) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) (IE7 scheint auch weg zu sein.) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe (Das File bekomme ich seit laengerem nicht mehr runter per Control Panel.) C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Nero\Nero8\InCD\NBHGui.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\Rundll32.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Documents and Settings\***\Desktop\ccsetup209.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\***\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://deutsch.eazel.com/de/index.php?rvs=hompag&d=79919281 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**ps://pansalto.cablecom.ch/wizlet/ReportAgent/reportAgentPrepare.do?embedded=false R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: {5fcc3769-b680-46c9-63d4-776bfa1e9050} - {0509e1af-b677-4d36-9c64-086b9673ccf5} - C:\WINDOWS\system32\eygqav.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: (no name) - {434480C0-E75B-4338-8BCC-B7299A8F4902} - C:\WINDOWS\system32\khfETllk.dll O2 - BHO: (no name) - {46632180-53B9-4AC3-AB03-F061C4A85B8B} - C:\WINDOWS\system32\hgGWpoPg.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [BMb7adb38f] Rundll32.exe "C:\WINDOWS\system32\uqsogikm.dll",s O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - h**p://messenger.zone.msn.com/DE-CH/a-UNO1/GAME_UNO1.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - h**p://**********.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - h**p://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - h**p://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O20 - Winlogon Notify: hgGWpoPg - C:\WINDOWS\SYSTEM32\hgGWpoPg.dll O20 - Winlogon Notify: tuvSmlLe - tuvSmlLe.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InCD Helper (InCDsrvR) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 10161 bytes |
Bei Service Pack 1 brauchst du nichts bereinigen, da so gut wie jeder Schädling auf dein System kann, auch Sasser und Mydoom. Daher: Image mit integr. SP3 drüberspielen. mfg |
Zitat:
Werd mal SP3 einspielen. Auch wenn ich SP1 seit laengerem benutze, die Probleme tauchten erst vorgestern auf, wieso denn das? |
Zitat:
|
Zitat:
Hab eben SP3 eingespielt. (Wieso zeigt mir HJT, dass ich immer noch SP1 benutze?) |
Ich bin auf meinem Test-PC 2 Jahre ohne jeden Patch gesurft und blieb von diversen Würmern verschont. Das Einzigste was ich bisher hatte, war ein Trojan.Inject, mehr auch nicht. Führe mal die genaue Anweisungen von MalwareBytes durch, Link in meiner Signatur. mfg |
Nach geschlagenen dreizehn Viertelstunden kann man schonmal durchdrehen... Hier der Log: Malwarebytes' Anti-Malware 1.21 Datenbank Version: 967 Windows 5.1.2600 Service Pack 1 01:51:52 20.07.2008 mbam-log-7-20-2008 (01-51-52).txt Scan-Methode: Vollständiger Scan (C:\|) Durchsuchte Objekte: 143648 Laufzeit: 3 hour(s), 15 minute(s), 45 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 3 Infizierte Registrierungsschlüssel: 17 Infizierte Registrierungswerte: 3 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 3 Infizierte Dateien: 29 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: C:\WINDOWS\system32\khfETllk.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\eygqav.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\hgGWpoPg.dll (Trojan.Vundo) -> Unloaded module successfully. Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0509e1af-b677-4d36-9c64-086b9673ccf5} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0509e1af-b677-4d36-9c64-086b9673ccf5} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{434480c0-e75b-4338-8bcc-b7299a8f4902} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{434480c0-e75b-4338-8bcc-b7299a8f4902} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{46632180-53b9-4ac3-ab03-f061c4a85b8b} (Trojan.BHO) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{46632180-53b9-4ac3-ab03-f061c4a85b8b} (Trojan.BHO) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{62d6dda7-8fe9-47f1-b8e9-d1d0d3d9ff3a} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Nvchost (Trojan.Goldun) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\hggwpopg (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{62d6dda7-8fe9-47f1-b8e9-d1d0d3d9ff3a} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmb7adb38f (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{46632180-53b9-4ac3-ab03-f061c4a85b8b} (Trojan.Vundo) -> Delete on reboot. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\khfetllk -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\khfetllk -> Delete on reboot. Infizierte Verzeichnisse: C:\Program Files\Helper (Adware.BHO) -> Quarantined and deleted successfully. C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\' (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINDOWS\system32\eygqav.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\khfETllk.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\kllTEfhk.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\kllTEfhk.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wvUoNHyv.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vyHNoUvw.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vyHNoUvw.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\hgGWpoPg.dll (Trojan.BHO) -> Delete on reboot. C:\WINDOWS\system32\geBtqNdc.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\orqkbjrq.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\WhoisCL.exe (Adware.BHO) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tuvVMfcc.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\***\Local Settings\Temp\tem1DE.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\***\Local Settings\Temporary Internet Files\Content.IE5\GVHQ3G2K\AV2009Install_77052205[1].exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Documents and Settings\***\Local Settings\Temporary Internet Files\Content.IE5\22UPC4G0\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\***\Local Settings\Temporary Internet Files\Content.IE5\22UPC4G0\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\b.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\uqsogikm.dll (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\cmd.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\system32\netstat.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ping.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\system32\regedit.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tasklist.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\system32\tracert.com (Worm.Alcra) -> Quarantined and deleted successfully. C:\WINDOWS\BMb7adb38f.xml (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\BMb7adb38f.txt (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\fccyvULe.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\***\Local Settings\Temp\software.php (Trojan.FakeAlert) -> Quarantined and deleted successfully. Soll ich nun nochmal Avast drueberjagen oder HJT? _________________________________________________ Edit: HJT-Log (nach Restart): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:09:40, on 20.07.2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Nero\Nero8\InCD\NBHGui.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\RTHDCPL.EXE (sieht suspekt aus) C:\WINDOWS\SOUNDMAN.EXE (dito) C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\WINDOWS\System32\msiexec.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\***\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\HiJackThis (2).exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://deutsch.eazel.com/de/index.php?rvs=hompag&d=79919281 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**ps://pansalto.cablecom.ch/wizlet/ReportAgent/reportAgentPrepare.do?embedded=false R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - h**p://messenger.zone.msn.com/DE-CH/a-UNO1/GAME_UNO1.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - h**p://*******.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - h**p://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://h**p://messenger.zone.msn.com...r.cab56986.cab O20 - Winlogon Notify: tuvSmlLe - tuvSmlLe.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InCD Helper (InCDsrvR) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 9643 bytes |
Hi,
Ich würd gern etwas überprüfen. :D Wegen dem SP1/SP3-Problem. :) lg myrtille |
Darfst du, myrtille :D Hab da was entdeckt, wo mich an das Problem von undoreal (http://www.trojaner-board.de/56162-r...tml#post355766) erinnert: Zitat:
|
hallo myrtille Erstmal danke, dass du mir helfen willst.:bussi: Tut mir leid, ich war wie immer ein wenig ungeduldig. IE offen > dss.exe gestartet > 2 Logfiles geclosed > IE geclosed > dss.exe gestartet > nur noch ein Log :( __________________________________________ Deckard's System Scanner v20071014.68 Run by xxx on 2008-07-20 02:21:31 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as xxx.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 02:21:32, on 20.07.2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\bgsvcgen.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Nero\Nero8\InCD\NBHGui.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe C:\Documents and Settings\xxx\Desktop\dss.exe C:\DOCUME~1\xxx\LOCALS~1\APPLIC~1\Opera\Opera\profile\cache4\TEMPOR~1\xxx.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://deutsch.eazel.com/de/index.php?rvs=hompag&d=79919281 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxps://pansalto.cablecom.ch/wizlet/ReportAgent/reportAgentPrepare.do?embedded=false R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - hxxp://messenger.zone.msn.com/DE-CH/a-UNO1/GAME_UNO1.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - hxxp://xxxxxxxxxxx.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - hxxp://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O20 - Winlogon Notify: tuvSmlLe - tuvSmlLe.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InCD Helper (InCDsrvR) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Nero Registry InCD Service (NeroRegInCDSrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\NBHRegInCDSrv.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 9450 bytes -- Files created between 2008-06-20 and 2008-07-20 ----------------------------- 2011-11-23 10:24:15 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2011-11-23 10:23:44 0 d-------- C:\Documents and Settings\xxx\Application Data\WLInstaller 2011-11-20 02:56:35 0 d-------- C:\Program Files\Dcads Advanced Toolbar 2008-07-19 22:41:59 0 d-------- C:\Documents and Settings\xxx\Application Data\Sun 2008-07-19 22:30:19 0 d-------- C:\Documents and Settings\xxx\Application Data\Malwarebytes 2008-07-19 22:30:16 0 d-------- C:\Documents and Settings\xxx\Application Data\Malwarebytes 2008-07-19 22:30:15 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-19 20:58:07 245760 --a------ C:\Program Files\Uninstall Ask Toolbar.dll <Not Verified; Ask.com; Ask Toolbar for Internet Explorer> 2008-07-19 20:33:18 0 d-------- C:\WINDOWS\Prefetch 2008-07-19 17:44:06 25936 --a------ C:\WINDOWS\System32\hgGWpoPg.dll 2008-07-19 15:24:59 2240917 --ahs---- C:\WINDOWS\System32\shdgcvoc.ini2 2008-07-18 20:23:58 102912 --a------ C:\WINDOWS\System32\eygqav.dll 2008-07-18 20:20:58 93696 -----n--- C:\WINDOWS\System32\uqsogikm.dll 2008-07-18 15:37:26 0 d-------- C:\Documents and Settings\xxx\Application Data\MSN6 2008-07-18 15:24:04 0 d-------- C:\Documents and Settings\xxx\Application Data\Opera 2008-07-18 03:26:25 0 d-------- C:\Documents and Settings\xxx\Application Data\Thinstall 2008-07-18 02:44:55 0 d-------- C:\Program Files\coolpro2 2008-07-18 01:46:42 0 d-------- C:\Documents and Settings\xxx\Application Data\Audacity 2008-07-18 00:47:34 0 d-------- C:\Program Files\Common Files\SWF Studio 2008-07-17 11:27:05 0 d-------- C:\Documents and Settings\xxx\Application Data\MSN6 2008-07-15 14:24:05 0 d-------- C:\Documents and Settings\xxx\Application Data\Macromedia 2008-07-15 14:08:08 0 d-------- C:\Documents and Settings\xxx\Application Data\Yahoo! 2008-07-15 14:07:38 0 d-------- C:\Documents and Settings\xxx\Application Data\Real 2008-07-15 14:07:38 0 d-------- C:\Documents and Settings\xxx\Application Data\Nero 2008-07-15 14:07:22 0 d-------- C:\Documents and Settings\xxx\Application Data\Identities 2008-07-15 14:07:08 0 d--h----- C:\Documents and Settings\xxx\Templates 2008-07-15 14:07:08 0 dr------- C:\Documents and Settings\xxx\Start Menu 2008-07-15 14:07:08 0 dr-h----- C:\Documents and Settings\xxx\SendTo 2008-07-15 14:07:08 0 dr-h----- C:\Documents and Settings\xxx\Recent 2008-07-15 14:07:08 0 d--h----- C:\Documents and Settings\xxx\PrintHood 2008-07-15 14:07:08 1310720 --ah----- C:\Documents and Settings\xxx\NTUSER.DAT 2008-07-15 14:07:08 0 d--h----- C:\Documents and Settings\xxx\NetHood 2008-07-15 14:07:08 0 dr------- C:\Documents and Settings\xxx\My Documents 2008-07-15 14:07:08 0 d--h----- C:\Documents and Settings\xxx\Local Settings 2008-07-15 14:07:08 0 dr------- C:\Documents and Settings\xxx\Favorites 2008-07-15 14:07:08 0 d-------- C:\Documents and Settings\xxx\Desktop 2008-07-15 14:07:08 0 d--hs---- C:\Documents and Settings\xxx\Cookies 2008-07-15 14:07:08 0 dr-h----- C:\Documents and Settings\xxx\Application Data 2008-07-15 14:07:08 0 d---s---- C:\Documents and Settings\xxx\Application Data\Microsoft 2008-07-14 13:28:02 0 d-------- C:\Documents and Settings\xxx\Application Data\Yahoo! 2008-07-11 23:16:12 0 d-------- C:\Documents and Settings\xxx\Application Data\Macromedia 2008-07-11 23:16:12 0 d-------- C:\Documents and Settings\xxx\Application Data\Adobe 2008-07-11 23:04:16 0 d-------- C:\Documents and Settings\xxx\Application Data\WinRAR 2008-07-11 22:54:48 0 d-------- C:\Documents and Settings\xxx\Application Data\Blender Foundation 2008-07-11 22:54:48 0 d-------- C:\Documents and Settings\xxx\Application Data\Blender Foundation 2008-07-11 22:43:40 0 d-------- C:\Documents and Settings\xxx\Application Data\DivX 2008-07-11 22:30:39 0 d-------- C:\Documents and Settings\xxx\Application Data\Apple Computer 2008-07-11 22:23:19 0 d-------- C:\Documents and Settings\xxx\Contacts 2008-07-11 22:19:53 0 d-------- C:\Documents and Settings\xxx\Application Data\Opera 2008-07-11 22:16:46 0 d-------- C:\Documents and Settings\xxx\Application Data\Nero 2008-07-11 22:16:44 0 d-------- C:\Documents and Settings\xxx\Application Data\Real 2008-07-11 22:16:34 0 d-------- C:\Documents and Settings\xxx\Application Data\Identities 2008-07-11 22:16:20 0 d--h----- C:\Documents and Settings\xxx\Templates 2008-07-11 22:16:20 0 dr------- C:\Documents and Settings\xxx\Start Menu 2008-07-11 22:16:20 0 dr-h----- C:\Documents and Settings\xxx\SendTo 2008-07-11 22:16:20 0 dr-h----- C:\Documents and Settings\xxx\Recent 2008-07-11 22:16:20 0 d--h----- C:\Documents and Settings\xxx\PrintHood 2008-07-11 22:16:20 2621440 --ah----- C:\Documents and Settings\xxx\NTUSER.DAT 2008-07-11 22:16:20 0 d--h----- C:\Documents and Settings\xxx\NetHood 2008-07-11 22:16:20 0 dr------- C:\Documents and Settings\xxx\My Documents 2008-07-11 22:16:20 0 d--h----- C:\Documents and Settings\xxx\Local Settings 2008-07-11 22:16:20 0 dr------- C:\Documents and Settings\xxx\Favorites 2008-07-11 22:16:20 0 d-------- C:\Documents and Settings\xxx\Desktop 2008-07-11 22:16:20 0 d---s---- C:\Documents and Settings\xxx\Cookies 2008-07-11 22:16:20 0 dr-h----- C:\Documents and Settings\xxx\Application Data 2008-07-09 17:16:31 0 d-------- C:\Documents and Settings\xxx\Application Data\Nero 2008-07-09 17:12:37 0 d-------- C:\Program Files\AskTBar 2008-07-09 16:45:01 0 d-------- C:\Program Files\Common Files\Nero 2008-06-25 14:31:33 0 d-------- C:\Program Files\MobMapUpdater 2008-06-20 19:30:02 0 d-------- C:\Logs -- Find3M Report --------------------------------------------------------------- 2008-07-19 21:07:38 0 d-------- C:\Program Files\Yahoo! 2008-07-19 21:00:32 0 d-------- C:\Program Files\DivX 2008-07-19 20:40:15 0 d--h----- C:\Program Files\WindowsUpdate 2008-07-19 20:20:54 0 d-------- C:\Program Files\Movie Maker 2008-07-19 20:20:07 23348 --a------ C:\WINDOWS\System32\emptyregdb.dat 2008-07-19 20:19:55 0 d-------- C:\Program Files\Windows NT 2008-07-18 20:54:28 0 d-------- C:\Program Files\Circle Developement 2008-07-18 02:44:15 0 d-------- C:\Program Files\Common Files\Download Manager 2008-07-18 00:47:34 0 d-------- C:\Program Files\Common Files 2008-07-17 17:21:22 0 d-------- C:\Program Files\Opera 2008-07-11 22:34:31 0 d-------- C:\Program Files\Apple Software Update 2008-07-09 16:56:18 0 d-------- C:\Program Files\Nero 2008-07-09 16:47:57 0 d-------- C:\Program Files\Common Files\Blizzard Entertainment 2008-07-05 13:19:25 0 d-------- C:\Program Files\LimeWire 2008-06-25 12:19:35 0 d-------- C:\Program Files\Common Files\Motive 2008-06-18 21:06:45 0 d-------- C:\Program Files\Blender Foundation 2008-06-17 20:42:28 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-17 19:54:22 0 d-------- C:\Program Files\Plug-ins 2008-06-11 02:07:20 3596288 --a------ C:\WINDOWS\System32\qt-dx331.dll 2008-06-11 02:03:26 196608 --a------ C:\WINDOWS\System32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-06-11 02:03:26 81920 --a------ C:\WINDOWS\System32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-06-11 02:03:20 802816 --a------ C:\WINDOWS\System32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-06-11 02:03:20 823296 --a------ C:\WINDOWS\System32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-06-11 02:03:20 815104 --a------ C:\WINDOWS\System32\divx_xx0a.dll <Not Verified; DivX, Inc.; DivX®> 2008-06-11 02:03:20 823296 --a------ C:\WINDOWS\System32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-06-11 02:03:18 683520 --a------ C:\WINDOWS\System32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-23 12:07:41 0 d-------- C:\Program Files\Messenger Plus! Live 2008-05-23 00:18:54 12288 --a------ C:\WINDOWS\System32\DivXWMPExtType.dll 2008-05-22 18:45:34 0 d-------- C:\Program Files\ICQ6 -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12.04.2007 17:44] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [29.06.2007 06:24] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [16.05.2008 01:19] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10.10.2007 20:51] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25.09.2007 02:11] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [28.01.2008 22:53] "SecurDisc"="C:\Program Files\Nero\Nero8\InCD\NBHGui.exe" [28.02.2008 17:39] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [28.04.2008 17:14] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [18.02.2008 17:29] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [15.08.2007 20:15] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [31.03.2003 14:00] "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [31.03.2003 14:00] "MSPY2002"="C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe" [31.03.2003 14:00] "PHIME2002ASync"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [31.03.2003 14:00] "PHIME2002A"="C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [31.03.2003 14:00] "nwiz"="nwiz.exe" [12.04.2007 17:44 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12.04.2007 17:44] "RTHDCPL"="RTHDCPL.EXE" [18.12.2006 10:00 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [16.05.2006 10:00 C:\WINDOWS\SkyTel.exe] "SoundMan"="SOUNDMAN.EXE" [21.07.2006 10:00 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [04.05.2006 10:00 C:\WINDOWS\alcwzrd.exe] "Alcmtr"="ALCMTR.EXE" [03.05.2005 10:00 C:\WINDOWS\Alcmtr.exe] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [28.02.2008 18:07] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [18.10.2007 12:34] "ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [31.03.2003 14:00] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [13.10.2004 18:24] C:\Documents and Settings\xxx\Start Menu\Programs\Startup\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [13.02.2001 01:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvSmlLe] tuvSmlLe.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" -- End of Deckard's System Scanner: finished at 2008-07-20 02:21:53 ------------ btw/ot: uff... Wie heisst denn die Funktion im Word, mit dem man Zeichen mit Zeichen ersetzen kann? (Engl. wie alles bei mir.) Edit: @Dark Viruz: Danke, ich les es mir mal durch. Edit 2: Danke Dark Viruz, danke myrtille. Es laggt gar nicht mehr und per Google lassen sich die Seiten auch wieder aufrufen. Aber so ganz sicher bin ich mir nicht, da ist bestimmt noch was auf der Kiste. :P |
Mach bitte mal folgendes: Dateien Online überprüfen lassen:
Code: C:\WINDOWS\System32\hgGWpoPg.dll
|
C:\WINDOWS\System32\hgGWpoPg.dll Code: Antivirus Version letzte aktualisierung Ergebnis C:\WINDOWS\System32\eygqav.dll Code: Antivirus Version letzte aktualisierung Ergebnis C:\WINDOWS\System32\uqsogikm.dll Code: Antivirus Version letzte aktualisierung Ergebnis |
Genau das 2. Log hätte ich aber gern gehabt. :p Entweder unter C:\deckard\systemscanner\ oder einem der unter ordner nach einer Datei names extra.txt schauen und diese dann hier posten. Oder: dss.exe auf den Desktop legen, unter Start->Ausführen->"%userprofile%\Desktop\dss.exe" /config eingeben. Dann unten rechts auf Check All klicken und anschließend auf Scan. Dann sollten zum Schluss des Scans 2 Dateien angezeigt werden. lg myrtille |
Tut mir leid, hier der Log: Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 1.0 Architecture: X86; Language: English CPU 0: Intel(R) Core(TM)2 CPU 6320 @ 1.86GHz CPU 1: Intel(R) Core(TM)2 CPU 6320 @ 1.86GHz Percentage of Memory in Use: 20% Physical Memory (total/avail): 2047.17 MiB / 1622.4 MiB Pagefile Memory (total/avail): 3943.53 MiB / 3529.78 MiB Virtual Memory (total/avail): 2047.88 MiB / 1920.29 MiB A: is Removable (Unformatted) C: is Fixed (NTFS) - 232.88 GiB total, 167.02 GiB free. D: is CDROM (No Media) E: is CDROM (No Media) \\.\PHYSICALDRIVE0 - Hitachi HDT725025VLA380 - 232.88 GiB - 1 partition \PARTITION0 (bootable) - Installable File System - 232.88 GiB - C: -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. -- Environment Variables ------------------------------------------------------- xxxSPROFILE=C:\Documents and Settings\xxx APPDATA=C:\Documents and Settings\xxx\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=xxx-5SFZCG ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\xxx LOGONSERVER=\\xxx-5SFZCG NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\WBEM;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Internet Explorer; PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0f06 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_02\lib\ext\QTJava.zip RNLOG_BASEKEY=Software\RealNetworks\RealPlayer\6.0\Preferences\BrowserRecordPluginLog SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\xxx\LOCALS~1\Temp TMP=C:\DOCUME~1\xxx\LOCALS~1\Temp USERDOMAIN=Jxxx-5SFZCG USERNAME=xxx USERPROFILE=C:\Documents and Settings\xxx windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- xxx (admin) xxx (admin) xxx (admin) xxx (admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> C:\WINDOWS\UNRecode.exe /UNINSTALL --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Anchor Service CS3 --> MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95} Adobe Asset Services CS3 --> MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61} Adobe Bridge CS3 --> MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394} Adobe Bridge Start Meeting --> MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23} Adobe Camera Raw 4.0 --> MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C} Adobe CMaps --> MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C} Adobe Color - Photoshop Specific --> MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E} Adobe Color Common Settings --> MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9} Adobe Color EU Extra Settings --> MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8} Adobe Color JA Extra Settings --> MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029} Adobe Color NA Recommended Settings --> MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5} Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39} Adobe Default Language CS3 --> MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D} Adobe Device Central CS3 --> MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD} Adobe ExtendScript Toolkit 2 --> MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2} Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Fonts All --> MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B} Adobe Help Center 1.0 --> MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001} Adobe Help Viewer CS3 --> MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245} Adobe Linguistics CS3 --> MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078} Adobe PDF Library Files --> MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C} Adobe Photoshop CS2 --> msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D} Adobe Photoshop CS3 --> C:\Program Files\Common Files\Adobe\Installers\2ac78060bc5856b0c1cf873bb919b58\Setup.exe Adobe Photoshop CS3 --> MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05} Adobe Reader 8.1.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81000000003} Adobe Setup --> MsiExec.exe /I{D1BB4446-AE9C-4256-9A7F-4D46604D2462} Adobe Stock Photos 1.0 --> MsiExec.exe /I{EE0D5DCD-2B97-4473-98DF-E93C0BD92F7A} Adobe Stock Photos CS3 --> MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183} Adobe Type Support --> MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312} Adobe Update Manager CS3 --> MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8} Adobe Version Cue CS3 Client --> MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5} Adobe WinSoft Linguistics Plugin --> MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6} Adobe XMP Panels CS3 --> MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923} Apple Mobile Device Support --> MsiExec.exe /I{763E8D6C-0098-4FF4-801A-3F311D2D9D80} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup BearShare MediaBar --> regsvr32 /u /s "C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll" CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" Command and Conquer Generals --> MsiExec.exe /I{E652CD92-FB19-40A4-B978-8453094F4EF5} GPL MPEG-1/2 DirectShow Decoder Filter --> MsiExec.exe /I{870815CA-6B60-47B6-88DD-A67F42D2F03E} HijackThis 2.0.2 --> "C:\Documents and Settings\xxx\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\HijackThis.exe" /uninstall HP Image Zone 3.5 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat HP PSC & OfficeJet 3.5 --> "C:\Program Files\HP\Digital Imaging\{18E0918E-1060-48f3-925C-56C82E88551B}\setup\hpzscr01.exe" -datfile hposcr03.dat HP Software Update --> MsiExec.exe /X{34957B51-9676-41CE-9E52-44AE91B73F1C} ICQ6 --> C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe -runfromtemp -l0x0009 -removeonly InCD Reader --> MsiExec.exe /X{A27281BC-98AA-4DC8-AA39-20B9E27B1033} iTunes --> MsiExec.exe /I{974C05A0-C76C-4724-A9A2-11D5D1355729} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} LimeWire 4.18.2 --> "C:\Program Files\LimeWire\uninstall.exe" Macromedia Dreamweaver 8 --> MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9} Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F} Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe" Messenger Plus! Live & Sponsor (CiD) --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe" Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9} Microsoft Text-to-Speech Engine 4.0 (English) --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\msTTS.inf, Uninstall Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Windows Journal Viewer --> MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8} Mouse Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2EBA5473-558B-462C-AEE4-FE50FA799F2A}\Setup.exe" MSXML 6.0 Parser (KB933579) --> MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} Nero 8 Trial --> MsiExec.exe /X{3C5F1B30-B10B-4579-86DD-D00F662E2052} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NVIDIA Drivers --> C:\WINDOWS\System32\nvudisp.exe UninstallGUI Opera 9.24 --> MsiExec.exe /X{16913489-B5E3-403E-AFD3-2B19BBE464D4} Opera 9.51 --> MsiExec.exe /X{179624B1-2683-45ED-965A-B72189EB5820} PDF Settings --> MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5} Quick Video Converter 3.50 --> "C:\Program Files\Quick Video Converter\unins000.exe" QuickTime --> MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC} RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Realtek High Definition Audio Driver --> RtlUpd.exe -r -m TMPGEnc DVD Author 3 with DivX Authoring Testversion --> MsiExec.exe /I{001B3D0B-07E2-411A-B849-797A1630600C} USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C8F7C1E5-0150-11D6-A96C-00D05908F85D}\Setup.exe" -l0x7 VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe Vtune 5.1 --> "C:\Program Files\Vtune\unins000.exe" Windows Communication Foundation --> MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333} Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Live Anmelde-Assistent --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Live installer --> MsiExec.exe /X{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6} Windows Live Mail --> MsiExec.exe /I{82F2B38B-1426-443D-874C-AC25675E7BEB} Windows Live Messenger --> MsiExec.exe /X{2B091530-69AA-442E-AB09-39ED06B58220} Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840} Windows Workflow Foundation --> MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD} WinRAR --> C:\Program Files\WinRAR\uninstall.exe WinZip 11.1 --> MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5} Wisdom-soft ScreenHunter 4.0 Free --> C:\PROGRA~1\WISDOM~1\UNWISE.EXE C:\PROGRA~1\WISDOM~1\INSTALL.LOG XML Paper Specification Shared Components Pack 1.0 --> -- Application Event Log ------------------------------------------------------- No Errors/Warnings found. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ No Errors/Warnings found. -- End of Deckard's System Scanner: finished at 2008-07-20 02:21:18 ------------ |
Hi, @log: Kein Thema. :D Ich hätt ja auch gleich dazusagen können, dass das Extralog nur beim ersten Mal erstellt wird. :D Wann hast du denn das SP3 installiert? :confused: Wirklich ALLES in deinem Log, deutet darauf hin, dass du nur das SP1 installiert hast. WindowsUpdates besuchen und schauen ob es Aktualisierungen gibt, die du installieren kannst. (Bitte den Internet Explorer benutzen) @Word weiß nicht genau was du meinst... Suchen und Ersetzen, vielleicht? Das könntest du dann mit strg +H aufrufen. @darkviruz Ja, ohne dein Post hätte ich mich aber auch nicht daran erinnert, dass gewisse Antivirenprogramme gelegentlich auch ein paar Dateien ungefragt erstellen. :D lg myrtille |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 15:09 Uhr. |
Copyright ©2000-2025, Trojaner-Board