Mein HiJackThis-LOG, habe explorer-Probleme
 

Hallo,
habe das Problem, dass mein explorer immer abstürzt, desktop dann komplett leer. vielleicht erkennt jemand das Problem in meinem Log :

StartupList report, 17.09.2004, 23:10:45
StartupList version: 1.52.2
Started from : F:\TEST\Virus_Wurm\hjt.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Programme_Test\MotherboardMonitor5\MBM5.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\Programme_Test\NetMeter\NetMeter.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
F:\TEST\Virus_Wurm\hjt.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
MBM 5 = "D:\Programme_Test\MotherboardMonitor5\MBM5.EXE"
AVGCtrl = "C:\Programme\AVPersonal\AVGNT.EXE" /min
TkBellExe = "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

D:\Programme_Test\NetMeter\NetMeter.exe = D:\Programme_Test\NetMeter\NetMeter.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Download Program Files:

[ppctlcab]
CODEBASE = http://www.pestscan.com/scanner/ppctlcab.cab
OSD = C:\WINDOWS\Downloaded Program Files\OSD406.OSD

[CoGSManager Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\GSManager.dll
CODEBASE = http://gamingzone.ubisoft.com/dev/pa.../GSManager.cab

[PPSDKActiveXScanner.MainScreen]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\PPSDKActiveXScanner.ocx
CODEBASE = http://www.pestscan.com/scanner/axscanner.cab

[Microsoft.WinRep]
InProcServer32 = C:\WINDOWS\System32\Winrep.dll
CODEBASE = https://webresponse.one.microsoft.co...veX/winrep.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\RdxIE.dll
CODEBASE = http://software-dl.real.com/133f5e1c...dxIE601_de.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://v5.windowsupdate.microsoft.co...?1093029709390

[HouseCall-Kontrolle]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab

[AvxScanOnline Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\BITDEF~1.OCX
CODEBASE = http://www.bitdefender.com/scan/Msie/bitdefender.cab

[{91413D86-9F27-402C-B5E3-DEBDD122C339}]
CODEBASE = http://content.netvenda.com/sites/ga.../de/games5.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\asinst.dll
CODEBASE = http://www.pandasoftware.com/activescan/as5/asinst.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupdate.microsoft.co...924.1870717593

[{A45F39DC-3608-4237-8F0E-139F1BC49464}]
CODEBASE = http://www.mymovielist.net/debby/plugin.exe

[WebResponseAttachments Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\FILETR~1.OCX
CODEBASE = https://webresponse.one.microsoft.co...X/FileXfer.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab

[IEPlugIn Class]
InProcServer32 = C:\Programme\my-playlist\ieudsplugin.dll
CODEBASE = http://install.cokemusic.de/client/p...LER_loader.exe

[EPSImageControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\EPScontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab

[MoneyTree Dialer]
CODEBASE = http://cdn.climaxbucks.com/internet-...istIOcrack.CAB

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 6.259 bytes
Report generated in 0,062 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Hallo DiRuKu,

würde es Dir etwas ausmachen, ein neues Logfile zu erstellen? Bitte verwende dies Mal http://www.trojaner-board.de/51130-a...ijackthis.html.

SD

hallo,
hier mein logfile von hjt 1982 :

Logfile of HijackThis v1.98.2
Scan saved at 15:01:25, on 18.09.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Programme_Test\MotherboardMonitor5\MBM5.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
D:\Programme_Test\NetMeter\NetMeter.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
F:\TEST\Virus_Wurm\HijackThis1982.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jufalu.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R3 - Default URLSearchHook is missing
O1 - Hosts: 212.227.118.74 www.jufalu.de
O1 - Hosts: 213.61.5.148 www.knuddels.de
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MBM 5] "D:\Programme_Test\MotherboardMonitor5\MBM5.EXE"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [D:\Programme_Test\NetMeter\NetMeter.exe] D:\Programme_Test\NetMeter\NetMeter.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Add bid - {866875B8-9855-48f8-BAAB-8002C325BE69} - D:\Programme_Test\LastMinuteGebot\plmg.exe (HKCU)
O9 - Extra 'Tools' menuitem: Add bid - {866875B8-9855-48f8-BAAB-8002C325BE69} - D:\Programme_Test\LastMinuteGebot\plmg.exe (HKCU)
O12 - Plugin for .mid: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .WAV: C:\Programme\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/pa.../GSManager.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.co...veX/winrep.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/133f5e1c...dxIE601_de.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093029709390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {91413D86-9F27-402C-B5E3-DEBDD122C339} - http://content.netvenda.com/sites/ga.../de/games5.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://www.mymovielist.net/debby/plugin.exe
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.co...X/FileXfer.cab
O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} (IEPlugIn Class) - http://install.cokemusic.de/client/p...LER_loader.exe
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet-...istIOcrack.CAB

Fixe mit HijackThis dies:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R3 - Default URLSearchHook is missing
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/p...s/GSManager.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.c...iveX/winrep.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/133f5e1...RdxIE601_de.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...b?1093029709390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {91413D86-9F27-402C-B5E3-DEBDD122C339} - http://content.netvenda.com/sites/g...l/de/games5.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A45F39DC-3608-4237-8F0E-139F1BC49464} - http://www.mymovielist.net/debby/plugin.exe
O16 - DPF: {A7E092C3-692A-11D0-A7E5-08002B322F3B} (WebResponseAttachments Control) - https://webresponse.one.microsoft.c...eX/FileXfer.cab
O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} (IEPlugIn Class) - http://install.cokemusic.de/client/...LLER_loader.exe
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/active...ol_v1-0-3-0.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} (MoneyTree Dialer) - http://cdn.climaxbucks.com/internet...DistIOcrack.CAB


Anschließend scanne mal mit eScan im abgesicherten Modus:
http://www.trojaner-board.de/showthread.php?t=6083

hallo,
habe alles gefixt und dann mit escan im abgesicherten
Mode gescannt. sieht nun ganz gut aus, glaube ich.
Vielen Dank mal und hier nocj der escan-log. Gruß
Dieter
*****
File D:\Homepage\JavaScripts\java.zip tagged as not-a-virus:JavaClass.Chart. No Action Taken.
File D:\NETZ_DIDI\Nina\bildchen nina\Brosis\dartsetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Programme_Test\MP3 to WAV Decoder\Trickler_PIC_M3_Development.exe infected by "not-a-virus:AdvWare.Gator" Virus. Action Taken: File Renamed.
File D:\System Volume Information\_restore{A5FE9F71-9481-424D-9B00-767831CB9E19}\RP4\A0007478.exe infected by "not-a-virus:AdvWare.Gator" Virus. Action Taken: File Renamed.
File F:\nokia\NSMA\nsma_setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\Cdr\Test\cdrdiag149.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\Jokes\HNY.exe tagged as not-a-virus:Simulator.Win16.MessageMates. No Action Taken.
File F:\Jokes\PC-Sheep.exe tagged as not-a-virus:Simulator.Win16.Sheep. No Action Taken.
File F:\TEST\TEST_alt\Spyware\aaw45.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\WIN95\PLISTEN.ZIP tagged as not-a-virus:Tool.Win32.Scream. No Action Taken.
File F:\TEST\TEST_alt\WIN95\acw201t.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\WIN95\nn29b.exe tagged as not-a-virus:NetTool.NukeNabber.21. No Action Taken.
File F:\TEST\TEST_alt\xxx\PINNVIDEO7\00\PRDPS7.RAR tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\xxx\PHOTOLINE8\PL32.001 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\10_03\GDiVX1.9.9.6.exe infected by "not-a-virus:AdvWare.Toolbar.GigatechSuperBar" Virus. Action Taken: File Renamed.
File F:\TEST\TEST_alt\ImTest\Steinberg Clean\WL_Lite\setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\W95\iVisit24b2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\W95\cdr37d-g.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\W95\ymsgrde.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\Spiele\backgammon.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\Spiele\poolsetup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\Spiele\pat.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\ImTest\W98\mp3towav.exe infected by "not-a-virus:AdvWare.Gator" Virus. Action Taken: File Renamed.
File F:\TEST\TEST_alt\ImTest\W98\s2k.020102.full.zip tagged as not-a-virus:RiskWare.Dialer.gen. No Action Taken.
File F:\TEST\TEST_alt\ImTest\W98\DivXPro5GAINBundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\pcshopping1002\pegasus_mail.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\TEST\TEST_alt\pcw1002\vnc_x86_win32.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.
File F:\DVD_Video\clad171FULL.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\DVD_Video\ra-codec12.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File F:\DVD_Video\CladDVD\c4.exe tagged as not-a-virus:Tool.Win32.Pcwelt.a. No Action Taken.
File G:\D_archivbak\Kopie von Homepage_230504\JavaScripts\java.zip tagged as not-a-virus:JavaClass.Chart. No Action Taken.
*****

Hast du immernoch das Problem?

Hallo,
ja, liegt wohl mehr am System. Explorer geht manchmal einfach weg und Desktop ist leer. Ich werde halt mal in den sauren Apfel beißen und neu installieren.
Vielen Dank für deine Mühe.
Gruß
Dieter