|
Internet Explorer - öffnet automatisch Werbung! Hallo Zusammen, ich habe hier schon mehrere Themen über dieses Problem nachgelesen und zum Teil auch schon Reinigungen durchgeführt. Problem: Wenn ich im Internet Explorer surfe, öffnet sich automatisch ein neues Tab. Vor meinen Reinigungen kam noch Werbung - jetzt nur noch eine weisse Seite. Folgende Reinigungen habe ich durchgeführt: - Kaspersky online Scan - Ad-Aware 2008 Systemprüfung - Malewarebytes Anti Maleware - Sbybot Search and Destroy Könntet Ihr bitte mein HiJackThis-Logfile anschauen und mir weitere Tipps geben. DANKE!! Anbei das HiJackThis-Logfile Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:15:19, on 09.10.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\PDF Complete\pdfsty.exe C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Spamihilator\spamihilator.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Users\smarty005\AppData\Local\ophipqy.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\ICQLite\ICQLite.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\conime.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\DllHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=none&bd=smb&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=none&bd=smb&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe" O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Spamihilator] "C:\Program Files\Spamihilator\spamihilator.exe" O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [ophipqy] "c:\users\smarty005\appdata\local\ophipqy.exe" ophipqy O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: Canon LBP2900 Statusfenster.lnk = C:\Windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~4.0_0\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.de/scan_de/scan8/oscan8.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: APSHook.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe -- End of file - 11166 bytes |
Nach der Reinigung mit dem CC-Cleaner hier das Log von COMBOFIX: ComboFix 08-10-08.05 - smarty005 2008-10-09 20:54:22.1 - NTFSx86 Microsoft® Windows Vista™ Business 6.0.6001.1.1252.1.1031.18.1106 [GMT 2:00] ausgeführt von:: C:\Users\smarty005\Desktop\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Users\smarty005\AppData\Local\ophipqy.dat C:\Users\smarty005\AppData\Local\ophipqy.exe C:\Users\smarty005\AppData\Local\ophipqy_nav.dat C:\Users\smarty005\AppData\Local\ophipqy_navps.dat C:\Windows\system32\x64 F:\Autorun.inf . ((((((((((((((((((((((( Dateien erstellt von 2008-09-09 bis 2008-10-09 )))))))))))))))))))))))))))))) . 2008-10-09 20:47 . 2008-10-09 20:47 <DIR> d-------- C:\Program Files\CCleaner 2008-10-09 19:59 . 2008-10-09 19:59 <DIR> d-------- C:\Windows\BDOSCAN8 2008-10-09 19:33 . 2008-10-09 20:49 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy 2008-10-09 19:33 . 2008-10-09 20:49 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy 2008-10-09 19:33 . 2008-10-09 20:11 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-10-09 19:29 . 2008-10-09 19:31 <DIR> d-------- C:\Users\All Users\Lavasoft 2008-10-09 19:29 . 2008-10-09 19:31 <DIR> d-------- C:\ProgramData\Lavasoft 2008-10-09 19:29 . 2008-10-09 19:29 <DIR> d-------- C:\Program Files\Lavasoft 2008-10-09 19:23 . 2008-10-09 19:23 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-09 16:45 . 2008-10-09 16:45 <DIR> d-------- C:\Users\smarty005\AppData\Roaming\Malwarebytes 2008-10-09 16:45 . 2008-10-09 16:45 <DIR> d-------- C:\Users\All Users\Malwarebytes 2008-10-09 16:45 . 2008-10-09 16:45 <DIR> d-------- C:\ProgramData\Malwarebytes 2008-10-09 16:45 . 2008-10-09 16:47 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-09 16:45 . 2008-09-10 00:04 38,528 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-10-09 16:45 . 2008-09-10 00:03 17,200 --a------ C:\Windows\System32\drivers\mbam.sys 2008-10-03 19:34 . 2008-10-03 19:34 <DIR> d-------- C:\Users\smarty005\AppData\Roaming\TVU Networks 2008-10-03 19:34 . 2008-10-03 19:34 <DIR> d-------- C:\Users\All Users\TVU Networks 2008-10-03 19:34 . 2008-10-03 19:34 <DIR> d-------- C:\ProgramData\TVU Networks 2008-10-03 19:20 . 2008-10-03 19:20 <DIR> d-------- C:\Windows\System32\PPLive 2008-10-02 10:20 . 2008-04-26 10:25 3,600,952 --a------ C:\Windows\System32\ntkrnlpa.exe 2008-10-01 19:07 . 2008-10-01 19:07 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-10-01 10:39 . 2008-10-01 10:39 <DIR> d-------- C:\PerfLogs 2008-10-01 09:51 . 2008-10-01 09:51 <DIR> d-------- C:\Windows\CheckSur 2008-10-01 09:48 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr 2008-10-01 09:47 . 2008-01-19 09:32 5,714,432 --a------ C:\Windows\System32\logon.scr 2008-10-01 09:46 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL 2008-10-01 09:45 . 2008-01-19 09:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll 2008-10-01 09:45 . 2008-01-19 09:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll 2008-10-01 09:45 . 2008-01-19 09:36 218,624 --a------ C:\Windows\System32\wdscore.dll 2008-10-01 09:45 . 2008-01-19 09:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll 2008-10-01 09:45 . 2008-01-19 09:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe 2008-10-01 09:44 . 2008-01-19 09:34 305,152 --a------ C:\Windows\System32\msdelta.dll 2008-10-01 09:44 . 2008-01-19 09:34 258,560 --a------ C:\Windows\System32\dpx.dll 2008-10-01 09:44 . 2008-01-19 09:34 246,784 --a------ C:\Windows\System32\drvstore.dll 2008-10-01 09:44 . 2008-01-19 09:35 35,328 --a------ C:\Windows\System32\mspatcha.dll 2008-09-27 12:10 . 2008-09-27 12:10 <DIR> d-------- C:\Users\All Users\Electronic Arts 2008-09-27 12:10 . 2008-09-27 12:10 <DIR> d-------- C:\ProgramData\Electronic Arts 2008-09-27 12:07 . 2008-03-05 15:56 3,786,760 --a------ C:\Windows\System32\D3DX9_37.dll 2008-09-27 12:07 . 2007-07-19 18:14 3,727,720 --a------ C:\Windows\System32\d3dx9_35.dll 2008-09-27 12:07 . 2007-05-16 16:45 3,497,832 --a------ C:\Windows\System32\d3dx9_34.dll 2008-09-27 12:07 . 2007-03-12 16:42 3,495,784 --a------ C:\Windows\System32\d3dx9_33.dll 2008-09-27 12:07 . 2006-11-29 13:06 3,426,072 --a------ C:\Windows\System32\d3dx9_32.dll 2008-09-27 12:07 . 2006-09-28 16:05 2,414,360 --a------ C:\Windows\System32\d3dx9_31.dll 2008-09-27 12:07 . 2007-04-04 18:53 81,768 --a------ C:\Windows\System32\xinput1_3.dll 2008-09-27 12:06 . 2005-05-26 15:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll 2008-09-16 06:33 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll 2008-09-16 06:33 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll 2008-09-16 06:33 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll 2008-09-16 06:33 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll 2008-09-16 06:33 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll 2008-09-16 06:33 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe 2008-09-16 06:33 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll 2008-09-16 06:33 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll 2008-09-16 06:33 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-09-11 21:12 . 2008-07-31 03:13 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll 2008-09-11 21:12 . 2008-06-26 05:29 303,616 --a------ C:\Windows\System32\wmpeffects.dll 2008-09-11 21:12 . 2008-07-31 05:32 28,160 --a------ C:\Windows\System32\Apphlpdm.dll . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-09 17:48 --------- d-----w C:\Users\smarty005\AppData\Roaming\Spamihilator 2008-10-09 17:28 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-10-01 08:50 174 --sha-w C:\Program Files\desktop.ini 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Sidebar 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Mail 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Journal 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Defender 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Collaboration 2008-10-01 08:41 --------- d-----w C:\Program Files\Windows Calendar 2008-10-01 08:30 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-10-01 08:30 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-09-27 10:10 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-15 15:43 --------- d-----w C:\Program Files\Hp 2008-08-17 11:43 307,968 ----a-w C:\Windows\System32\TuneUpDefragService.exe 2008-08-17 11:43 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-08-14 17:38 --------- d-----w C:\Program Files\HO_1421 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-07-16 01:32 2,048 ----a-w C:\Windows\System32\tzres.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PDF Complete"="C:\Program Files\PDF Complete\pdfsty.exe" [2007-05-08 331552] "PTHOSTTR"="C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632] "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128] "HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-02 163840] "CognizanceTS"="C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "Spamihilator"="C:\Program Files\Spamihilator\spamihilator.exe" [2008-04-05 1060864] "WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2007-05-23 192512] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-09-13 141848] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-09-13 154136] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-09-13 129560] "SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "ST Recovery Launcher"="C:\Windows\SMINST\launcher.exe" [2007-03-09 44168] C:\Users\smarty005\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 719664] Canon LBP2900 Statusfenster.lnk - C:\Windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE [2008-04-19 50848] DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2008-01-14 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=APSHook.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ SbHpNp scecli ASWLNPkg [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "ICQ Lite"="C:\Program Files\ICQLite\ICQLite.exe" -minimize [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "TCP Query User{76F8E7EB-3E76-4E94-9B6A-D8802C75512F}C:\\program files\\icqlite\\icqlite.exe"= UDP:C:\program files\icqlite\icqlite.exe:ICQLite "UDP Query User{A20C9CFE-41C7-4734-B074-4DC469D14DD2}C:\\program files\\icqlite\\icqlite.exe"= TCP:C:\program files\icqlite\icqlite.exe:ICQLite "{397E9E12-4334-4B66-A65F-1D4AD15BF912}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{4446B9FA-002D-4F15-8495-035FF9CEC37D}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{903A2383-DCCE-4DE5-B3F4-0BA1A30109E9}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{3C1323CE-C24D-4048-AC4D-B55C78442BF8}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{CEA8A723-16CF-4C79-9D9C-1954342071D7}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{14E72224-1DEA-4ADC-B5F4-B2458D1872C0}C:\\program files\\spamihilator\\dccproc.exe"= UDP:C:\program files\spamihilator\dccproc.exe:dccproc "UDP Query User{96EF272D-730F-40AD-99DA-8A44CE300829}C:\\program files\\spamihilator\\dccproc.exe"= TCP:C:\program files\spamihilator\dccproc.exe:dccproc "TCP Query User{B9A8698B-C095-4774-ACC2-327B35FB7B3D}C:\\program files\\hp\\hp software update\\hpwucli.exe"= UDP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client "UDP Query User{4370C719-C449-4C2C-8E21-556C6B27A840}C:\\program files\\hp\\hp software update\\hpwucli.exe"= TCP:C:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client "TCP Query User{D46DAACC-D714-425B-AF7F-3F058D495006}C:\\program files\\icq6\\icq.exe"= UDP:C:\program files\icq6\icq.exe:ICQ Library "UDP Query User{C1AD31D2-9A4D-49D9-B25B-AE3EE40EF699}C:\\program files\\icq6\\icq.exe"= TCP:C:\program files\icq6\icq.exe:ICQ Library "TCP Query User{F2F4C83A-D9DA-429A-8CE2-377CDF2A75B2}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{D0EFDDD5-D7DA-4288-8534-43B9431DE6D3}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "{FEEC1330-0F72-4C61-A8A1-80444D8705A4}"= UDP:C:\Windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process "{A025567F-34A2-4F18-A707-9E7F7A7364B5}"= TCP:C:\Windows\System32\CNAB4RPK.EXE:Canon LBP2900 RPC Server Process "{D6A2177C-DA31-44C2-B04A-3A6B587EDC02}"= TCP:19375|C:\Program Files\devolo\dlanwlancfg\dlanwlancfg.exe:devolo dLAN Wireless extender Konfiguration "{ACD82C04-2796-40E9-9A5E-D21B9BE3F734}"= UDP:10300|C:\Program Files\devolo\informer\devinf.exe:devolo Informer "{A9BE20D9-E6B0-4FD6-AC9C-3A7A9B71014E}"= TCP:10301|LPort=19375|C:\Program Files\devolo\informer\devinf.exe:devolo Informer "{1F8295DD-F932-4CC5-BB6C-07CDC73ECBE0}"= TCP:12345|C:\Program Files\devolo\easyshare\easyshare.exe:devolo EasyShare "{EF0FA780-B01D-4724-A8F8-2438C18F3B9D}"= UDP:12346|LPort=12347|C:\Program Files\devolo\easyshare\easyshare.exe:devolo EasyShare "TCP Query User{B0C795BF-1CCE-4CDF-B00C-868FD3FC5537}C:\\users\\smarty005\\appdata\\local\\temp\\tmp22df.tmp\\update.exe"= UDP:C:\users\smarty005\appdata\local\temp\tmp22df.tmp\update.exe:update.exe "UDP Query User{BA5AAA12-8863-42F1-A5BB-00811E4DA652}C:\\users\\smarty005\\appdata\\local\\temp\\tmp22df.tmp\\update.exe"= TCP:C:\users\smarty005\appdata\local\temp\tmp22df.tmp\update.exe:update.exe "TCP Query User{34D33508-6C4D-4A82-99F4-B06F5D47A0B8}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{B7E6311C-E672-4885-AB50-630E6ECEB10F}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{52A46E38-05A6-49BD-B33F-DCC608970569}C:\\program files\\icqlite\\icqlite.exe"= UDP:C:\program files\icqlite\icqlite.exe:ICQLite "UDP Query User{1137EAFB-9C02-41E5-9C96-ADC76441839E}C:\\program files\\icqlite\\icqlite.exe"= TCP:C:\program files\icqlite\icqlite.exe:ICQLite "TCP Query User{6FF90A33-5863-4074-87B8-F49B18E2ADC1}C:\\program files\\miranda im\\miranda32.exe"= UDP:C:\program files\miranda im\miranda32.exe:Miranda IM "UDP Query User{2129E118-5E72-4DE7-87C5-7C612CDFDBC5}C:\\program files\\miranda im\\miranda32.exe"= TCP:C:\program files\miranda im\miranda32.exe:Miranda IM "TCP Query User{D0E5F611-4866-46B8-B1CF-E98527595273}C:\\program files\\electronic arts\\eadm\\core.exe"= UDP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "UDP Query User{23CBB635-F10D-4850-BB98-F884C1618F60}C:\\program files\\electronic arts\\eadm\\core.exe"= TCP:C:\program files\electronic arts\eadm\core.exe:EA Download Manager "TCP Query User{9132624D-C024-4E55-B04B-B2DCB93461F6}C:\\users\\smarty005\\appdata\\local\\temp\\tmp759c.tmp\\update.exe"= UDP:C:\users\smarty005\appdata\local\temp\tmp759c.tmp\update.exe:update.exe "UDP Query User{47502F80-3A5F-4E1B-A4B4-26ABA4D38C41}C:\\users\\smarty005\\appdata\\local\\temp\\tmp759c.tmp\\update.exe"= TCP:C:\users\smarty005\appdata\local\temp\tmp759c.tmp\update.exe:update.exe "{70A047B0-E5FE-4ADA-B584-4AFA8E4BC25C}"= UDP:C:\Program Files\PPLive\PPLive.exe:PPLive "{4910C019-7665-42DA-87DC-3612A8ADE5C3}"= TCP:C:\Program Files\PPLive\PPLive.exe:PPLive "TCP Query User{F3EBDEFF-8F58-4B36-A76D-91F4E057803E}C:\\program files\\tvuplayer\\tvuplayer.exe"= UDP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component "UDP Query User{E95CAA37-B4BC-4C02-9BC3-458A44088257}C:\\program files\\tvuplayer\\tvuplayer.exe"= TCP:C:\program files\tvuplayer\tvuplayer.exe:TVUPlayer Component R0 SbAlg;SbAlg;C:\Windows\system32\drivers\SbAlg.sys [2006-10-09 44720] R0 SbFsLock;SbFsLock;C:\Windows\system32\drivers\SbFsLock.sys [2007-03-29 13696] R1 RsvLock;RsvLock;C:\Windows\system32\drivers\RsvLock.sys [2007-04-22 5808] R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632] R2 ASBroker;Anmeldesitzungsbroker;C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 ASChannel;Lokaler Verbindungskanal;C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 HpFkCryptService;Drive Encryption Service;c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2007-04-22 221184] R2 hpsrv;HP Service;C:\Windows\system32\Hpservice.exe [2007-01-05 18944] R2 NPF_devolo;NetGroup Packet Filter Driver (devolo);C:\Windows\system32\drivers\npf_devolo.sys [2007-02-07 35840] R2 pdfcDispatcher;PDF Document Manager;C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448] R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2008-01-19 21504] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-02-26 179712] R3 btwaudio;Bluetooth-Audiogerät;C:\Windows\system32\drivers\btwaudio.sys [2007-05-11 79664] R3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-05-11 81200] R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-05-11 16432] S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2008-08-17 307968] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc bthsvcs REG_MULTI_SZ BthServ Cognizance REG_MULTI_SZ ASBroker ASChannel HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Inhalt des "geplante Tasks" Ordners 2008-10-09 C:\Windows\Tasks\1-Klick-Wartung.job - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-29 09:58] 2008-10-08 C:\Windows\Tasks\User_Feed_Synchronization-{F8821C4C-6A9F-47C2-BE00-2BB4E22DED9D}.job - C:\Windows\system32\msfeedssync.exe [2008-01-19 09:33] . - - - - Entfernte verwaiste Registrierungseinträge - - - - HKCU-Run-ophipqy - c:\users\smarty005\appdata\local\ophipqy.exe . ------- Zusätzlicher Suchlauf ------- . FireFox -: Profile - C:\Users\smarty005\AppData\Roaming\Mozilla\Firefox\Profiles\hecgxad2.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.t-online.de/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-09 21:02:01 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . ------------------------ Weitere laufende Prozesse ------------------------ . C:\Windows\System32\audiodg.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Windows\System32\agrsmsvc.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe C:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe C:\Windows\System32\CNAB4RPK.EXE C:\Windows\System32\conime.exe C:\Windows\SMINST\Scheduler.exe C:\Windows\System32\igfxsrvc.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\System32\wbem\WMIADAP.exe . ************************************************************************** . Zeit der Fertigstellung: 2008-10-09 21:08:08 - PC wurde neu gestartet ComboFix-quarantined-files.txt 2008-10-09 19:07:49 Vor Suchlauf: 10 Verzeichnis(se), 119.394.275.328 Bytes frei Nach Suchlauf: 20 Verzeichnis(se), 118,895,046,656 Bytes frei 267 --- E O F --- 2008-10-08 18:22:28 |
nachdem ich das Sytem mit dem C-Cleaner gescannt hatte und danach Combofix ausgeführt hatte, kommen keine Werbefenster mehr. Könnte mir bitte einer von Euch trotzdem am HiJackThis-Log oben sagen, welcher Bestandteil der Übeltäter war?! |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 22:33 Uhr. |
Copyright ©2000-2025, Trojaner-Board