Pop-up Alarm
 

Hallo Community. Seit einiger Zeit oeffnen sich bei mir ohne Vorwarnung haufenweise Pop-ups. Egal wo ich surfe. Alle 5 min Werbungssites von DarkOrbit usw. Kann sein das ich mir da was eingefangen habe bei irgendnem Download. Konnt ihr mir weiterhelfen ? Sollte ich vllt mein System Defragmentieren ? Oder was an der HiJackThis-Log File aendern. Wenn ja dann wie ?:snyper: Mein Inet lauft seitdem auch Langsam ... laedt zum Teil langsam und auch alle 10 min kommt die Meldung "kein antwort" ... ich hoffe ich muss nicht formatieren.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:34:52 PM, on 8/29/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\***\Program Files\DNA\btdna.exe
C:\Program Files\phonostar\ps_timer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://search.conduit.com?SearchSource=10&ctid=CT1750559
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Media Access Startup - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\1.5.5.900\HPIEAddOn.dll
O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPIEAddOn.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: System Search Dispatcher - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - C:\Program Files\System Search Dispatcher\1.3.5.960\ssd.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll
O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: MediaBar - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll
O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Cosmina\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [PhonostarTimer] C:\Program Files\phonostar\ps_timer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: SecretCity 3DChat - {D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - C:\PROGRA~1\SECRET~1\\SECRET~1.EXE (file missing)
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F4089DF-130F-47E5-893F-7F08A99B82C7}: NameServer = 193.231.236.25 193.231.236.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Sukoku Service - Unknown owner - C:\ProgramData\Sukoku\sukoku115.exe

--
End of file - 7177 bytes

Hallo und :hallo:

Dein Log sieht aus wie ein Schlachtfeld. :) Befindest du dich zur Zeit in Rumänien nähe Bukarest?

Klicke auf "Für alle Neuen" in meiner Signatur, lies alles aufmerksam und arbeite die komplette Liste unter Punkt 2 ab.

ciao, andreas

ok ich versuchs.... hilft es denn mein Problem zu beheben ?

ciao, andreas

Ahm ja bin im Urlaub... ist das den wichtig :) xD ... gott ich will bitte das Problem loesen. Ich folge deinen Schritten dort und posten gleich die Ergebnisse hier.

Kannst du jetzt schon was sagen ? Ob es noch zu retten ist ?

Eine rumänische IP auf einem deutschen Rechner ist schon ungewöhnlich, aber wenn es passt, dann müssen wir da nichts ändern.

Hinweis an Vistabenutzer: Alle Programme mit Mausklick rechts => Ausführen als Administrator starten.

1.) Starte HJT => Do a system scan only => Markiere:
=> Fix checked => Neustart

2.) Lade bitte die Datei
bei uns hoch => http://www.trojaner-board.de/54791-a...ner-board.html (nur Schritt 2)

ciao, andreas

Soll ich also alles markieren und fixen ???

Ja. :)

ciao, andreas

Gut ... habe Sudoku hochgeladen. Soll ich das mit dem Fixen sofort machen oder erst die Malwarebytes zum Ende kommen lassen ??:schmoll:

Lass Malwarebytes erst durchlaufen und poste das Log. Der wird es hoffentlich erkennen.

ciao, andreas

Hoffentlich .... :party:

Folgendes Ergab sich aus dem Scan. Selbst ich erkenne das dies nix gutes ist, hoffe aber weiterhin um die Formatierung drum rum zu kommen.


Malwarebytes' Anti-Malware 1.40
Datenbank Version: 2551
Windows 6.0.6000

8/29/2009 2:54:41 PM
mbam-log-2009-08-29 (14-54-41).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 165364
Laufzeit: 28 minute(s), 56 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 4
Infizierte Registrierungsschlüssel: 27
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 19
Infizierte Dateien: 35

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
C:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\explorerbar.funexplorer (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{ac5ab953-ed25-4f9c-87f0-b086b0178ffa} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6160f76a-1992-4b17-a32d-0c706d159105} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funexplorer.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{883dfc00-8a21-411d-956c-73a4e4b7d16f} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{480098c6-f6ad-4c61-9b5c-2bae228a34d1} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cdbfb47b-58a8-4111-bf95-06178dce326d} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\explorerbar.funredirector.1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{877f3eab-4462-44df-8475-6064eafd7fbf} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c28a0312-c403-417b-a425-a915bc0519cd} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35b8d58c-b0cb-46b0-ba64-05b3804e4e86} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1fb52ab3-5987-45a2-85e0-f3ec30dddc29}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{16b6279b-9ff5-41fb-8bf9-404324f5dd1f}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{c5096216-7703-409e-b85a-8a6ee7395128}}_is1 (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\{5617ECA9-488D-4BA2-8562-9710B9AB78D2} (Adware.DoubleD) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{0ba0192d-94a5-45e3-b2b8-3ec5a1a0b5ec} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions\{2224e955-00e9-4613-a844-ce69fccaae91} (Adware.DoubleD) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{5617eca9-488d-4ba2-8562-9710b9ab78d2} (Adware.DoubleD) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
C:\Program Files\DoubleD (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\DoubleD\GamingHarbor Toolbar (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900 (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\components (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500 (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\Data (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome\content (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\components (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\System Search Dispatcher (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960 (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\Data (Adware.DoubleD) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Program Files\Media Access Startup\1.5.5.900\HPIEAddOn.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\ssd.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPIEAddOn.dll (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\HPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\hppx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\MAHelper.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\HPAddOn.jar (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\chrome\content\HPAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFAddOn.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Media Access Startup\1.5.5.900\FF\components\HPFFHelperComponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\adwpx.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\NPCommon.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\Data\config.md (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome.manifest (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\install.rdf (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome\NPAddOn.jar (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome\content\NPAddOn.js (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\chrome\content\NPAddOn.xul (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\components\NPFFAddOn.dll (Adware.DoubleD) -> Delete on reboot.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\components\NPFFAddOn.xpt (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\Internet Saving Optimizer\3.6.3.4500\FF\components\NPFFHelperComponent.js (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\unins000.dat (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\unins000.exe (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\Data\eacore.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLDynamic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
C:\Program Files\System Search Dispatcher\1.3.5.960\Data\URLStatic.mx (Adware.DoubleD) -> Quarantined and deleted successfully.
:heulen:

Nicht weinen, das wird schon wieder. :) Die Funde von Malwarebytes sind nicht wirklich schlimm. Du solltest in Zukunft aber etwas vorsichtiger mit Laden aus dem Internet und Installieren sein. Jetzt führe das Fixen durch und starte den Rechner neu.

Versuchen wir es anschließend noch mit http://www.trojaner-board.de/51871-a...tispyware.html

ciao, andreas

Danke. Was is den aber mit RSIT ?...mhm gut gefixt hab ich nun zu superspyware

Poste beide Logs von RSIT, das kannst du auch starten, solange SuperAntiSpyware läuft.

Gehen denn noch immer Fenster auf?

ciao, andreas

Mhm also bis jetzt Pop - Up Frei. Kann es sein das das Problem behoben ist >???

Logfile of random's system information tool 1.06 (written by random/random)
Run by **** at 2009-08-29 15:34:15
Microsoft® Windows Vista™ Ultimate
System drive C: has 14 GB (34%) free of 41 GB
Total RAM: 1919 MB (41% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:34:19 PM, on 8/29/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Lexmark 1200 Series\LXCZbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Cosmina\Program Files\DNA\btdna.exe
C:\Program Files\phonostar\ps_timer.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Cosmina\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Cosmina.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\****\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [PhonostarTimer] C:\Program Files\phonostar\ps_timer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O9 - Extra button: SecretCity 3DChat - {D401C3A2-12EF-4D1D-A086-F3AB10B565BF} - C:\PROGRA~1\SECRET~1\\SECRET~1.EXE (file missing)
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F4089DF-130F-47E5-893F-7F08A99B82C7}: NameServer = 193.231.236.25 193.231.236.30
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: lxcz_device - - C:\Windows\system32\lxczcoms.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Sukoku Service - Unknown owner - C:\ProgramData\Sukoku\sukoku115.exe

--
End of file - 4220 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-02 1004136]
"lxczbmgr.exe"=C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe [2007-04-19 74672]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-10-01 4702208]
"Skytel"=C:\Windows\Skytel.exe [2007-08-03 1826816]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-09-12 36352]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-08-20 149280]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2006-11-02 1196032]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-05-26 4351216]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-07-16 25604904]
"BitTorrent DNA"=C:\Users\Cosmina\Program Files\DNA\btdna.exe [2009-08-19 318272]
"PhonostarTimer"=C:\Program Files\phonostar\ps_timer.exe [2009-05-13 126976]
"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-08-05 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2009-08-29 15:16:23 ----D---- C:\ProgramData\SUPERAntiSpyware.com
2009-08-29 15:16:05 ----D---- C:\Users\Cosmina\AppData\Roaming\SUPERAntiSpyware.com
2009-08-29 15:16:05 ----D---- C:\Program Files\SUPERAntiSpyware
2009-08-29 15:15:34 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-08-29 15:02:09 ----D---- C:\rsit
2009-08-29 14:24:46 ----D---- C:\Users\Cosmina\AppData\Roaming\Malwarebytes
2009-08-29 14:24:40 ----D---- C:\ProgramData\Malwarebytes
2009-08-29 14:24:40 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-08-29 14:20:10 ----D---- C:\Program Files\Defraggler
2009-08-28 23:16:27 ----D---- C:\Program Files\NCH Swift Sound
2009-08-27 16:59:42 ----A---- C:\Windows\system32\wgaer_m.exe
2009-08-27 15:01:38 ----D---- C:\Users\Cosmina\AppData\Roaming\IrfanView
2009-08-27 15:01:38 ----D---- C:\Program Files\IrfanView
2009-08-27 12:31:33 ----A---- C:\Windows\system32\tzres.dll
2009-08-27 12:30:23 ----A---- C:\Windows\system32\winipsec.dll
2009-08-27 12:30:23 ----A---- C:\Windows\system32\polstore.dll
2009-08-27 12:30:23 ----A---- C:\Windows\system32\IPSECSVC.DLL
2009-08-27 12:30:23 ----A---- C:\Windows\system32\FwRemoteSvr.dll
2009-08-27 12:29:38 ----A---- C:\Windows\system32\msoeacct.dll
2009-08-27 12:29:38 ----A---- C:\Windows\system32\ACCTRES.dll
2009-08-27 12:29:37 ----A---- C:\Windows\system32\msoert2.dll
2009-08-27 12:29:01 ----A---- C:\Windows\system32\WebClnt.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\t2embed.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\lpk.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\fontsub.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\dciman32.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\atmlib.dll
2009-08-27 12:27:45 ----A---- C:\Windows\system32\atmfd.dll
2009-08-27 12:26:57 ----A---- C:\Windows\system32\winsrv.dll
2009-08-27 12:26:57 ----A---- C:\Windows\system32\csrsrv.dll
2009-08-27 12:25:43 ----A---- C:\Windows\system32\winhttp.dll
2009-08-27 12:25:05 ----A---- C:\Windows\system32\atl.dll
2009-08-27 12:24:28 ----A---- C:\Windows\system32\gdi32.dll
2009-08-27 12:23:08 ----A---- C:\Windows\system32\xolehlp.dll
2009-08-27 12:23:08 ----A---- C:\Windows\system32\msdtcprx.dll
2009-08-27 12:22:30 ----A---- C:\Windows\system32\wkssvc.dll
2009-08-27 12:21:42 ----A---- C:\Windows\system32\tsgqec.dll
2009-08-27 12:21:42 ----A---- C:\Windows\system32\mstscax.dll
2009-08-27 12:21:42 ----A---- C:\Windows\system32\aaclient.dll
2009-08-27 12:21:00 ----A---- C:\Windows\system32\wmpeffects.dll
2009-08-27 12:20:15 ----A---- C:\Windows\system32\msxml3.dll
2009-08-27 12:20:14 ----A---- C:\Windows\system32\msxml3r.dll
2009-08-27 12:19:30 ----A---- C:\Windows\system32\msscp.dll
2009-08-27 12:18:55 ----A---- C:\Windows\system32\wfapigp.dll
2009-08-27 12:18:55 ----A---- C:\Windows\system32\MPSSVC.dll
2009-08-27 12:18:55 ----A---- C:\Windows\system32\icfupgd.dll
2009-08-27 12:18:55 ----A---- C:\Windows\system32\FirewallAPI.dll
2009-08-27 12:18:54 ----A---- C:\Windows\system32\iphlpsvc.dll
2009-08-27 12:18:54 ----A---- C:\Windows\system32\cmifw.dll
2009-08-27 12:18:18 ----A---- C:\Windows\system32\netapi32.dll
2009-08-27 12:16:37 ----A---- C:\Windows\system32\shell32.dll
2009-08-27 12:15:44 ----A---- C:\Windows\system32\localspl.dll
2009-08-27 12:15:11 ----A---- C:\Windows\system32\msvidc32.dll
2009-08-27 12:15:11 ----A---- C:\Windows\system32\msvfw32.dll
2009-08-27 12:15:11 ----A---- C:\Windows\system32\mciavi32.dll
2009-08-27 12:15:11 ----A---- C:\Windows\system32\avifil32.dll
2009-08-27 12:15:11 ----A---- C:\Windows\system32\avicap32.dll
2009-08-27 12:15:10 ----A---- C:\Windows\system32\msrle32.dll
2009-08-27 12:14:30 ----A---- C:\Windows\system32\DWWIN.EXE
2009-08-27 12:14:02 ----A---- C:\Windows\explorer.exe
2009-08-27 12:11:39 ----A---- C:\Windows\system32\wdigest.dll
2009-08-27 12:11:39 ----A---- C:\Windows\system32\kerberos.dll
2009-08-27 12:11:38 ----A---- C:\Windows\system32\secur32.dll
2009-08-27 12:11:38 ----A---- C:\Windows\system32\msv1_0.dll
2009-08-27 12:11:38 ----A---- C:\Windows\system32\lsass.exe
2009-08-27 12:11:38 ----A---- C:\Windows\system32\lsasrv.dll
2009-08-27 12:11:37 ----A---- C:\Windows\system32\schannel.dll
2009-08-27 12:10:43 ----A---- C:\Windows\system32\tcpipcfg.dll
2009-08-27 12:10:43 ----A---- C:\Windows\system32\netiougc.exe
2009-08-27 12:10:43 ----A---- C:\Windows\system32\netcfg.exe
2009-08-27 12:09:43 ----A---- C:\Windows\system32\NlsLexicons0047.dll
2009-08-27 12:09:43 ----A---- C:\Windows\system32\NlsLexicons0046.dll
2009-08-27 12:09:43 ----A---- C:\Windows\system32\NlsLexicons0045.dll
2009-08-27 12:09:42 ----A---- C:\Windows\system32\NlsLexicons0049.dll
2009-08-27 12:09:42 ----A---- C:\Windows\system32\NlsLexicons0039.dll
2009-08-27 12:09:42 ----A---- C:\Windows\system32\NlsLexicons0020.dll
2009-08-27 12:09:40 ----A---- C:\Windows\system32\NlsLexicons0022.dll
2009-08-27 12:09:40 ----A---- C:\Windows\system32\NlsLexicons0021.dll
2009-08-27 12:09:39 ----A---- C:\Windows\system32\NlsLexicons0027.dll
2009-08-27 12:09:39 ----A---- C:\Windows\system32\NlsLexicons0026.dll
2009-08-27 12:09:39 ----A---- C:\Windows\system32\NlsLexicons0024.dll
2009-08-27 12:09:39 ----A---- C:\Windows\system32\NlsLexicons0010.dll
2009-08-27 12:09:38 ----A---- C:\Windows\system32\NlsLexicons0019.dll
2009-08-27 12:09:38 ----A---- C:\Windows\system32\NlsLexicons0018.dll
2009-08-27 12:09:38 ----A---- C:\Windows\system32\NlsLexicons0013.dll
2009-08-27 12:09:38 ----A---- C:\Windows\system32\NlsLexicons0011.dll
2009-08-27 12:09:37 ----A---- C:\Windows\system32\NlsLexicons0001.dll
2009-08-27 12:09:36 ----A---- C:\Windows\system32\NlsLexicons0003.dll
2009-08-27 12:09:36 ----A---- C:\Windows\system32\NlsLexicons0002.dll
2009-08-27 12:09:35 ----A---- C:\Windows\system32\NlsLexicons004b.dll
2009-08-27 12:09:35 ----A---- C:\Windows\system32\NlsLexicons004a.dll
2009-08-27 12:09:35 ----A---- C:\Windows\system32\NlsLexicons0009.dll
2009-08-27 12:09:35 ----A---- C:\Windows\system32\NlsLexicons0007.dll
2009-08-27 12:09:34 ----A---- C:\Windows\system32\NlsLexicons004e.dll
2009-08-27 12:09:34 ----A---- C:\Windows\system32\NlsLexicons004c.dll
2009-08-27 12:09:34 ----A---- C:\Windows\system32\NlsLexicons003e.dll
2009-08-27 12:09:34 ----A---- C:\Windows\system32\NlsLexicons002a.dll
2009-08-27 12:09:33 ----A---- C:\Windows\system32\NlsLexicons001d.dll
2009-08-27 12:09:33 ----A---- C:\Windows\system32\NlsLexicons001b.dll
2009-08-27 12:09:33 ----A---- C:\Windows\system32\NlsLexicons001a.dll
2009-08-27 12:09:32 ----A---- C:\Windows\system32\NlsLexicons000a.dll
2009-08-27 12:09:31 ----A---- C:\Windows\system32\NlsLexicons000d.dll
2009-08-27 12:09:31 ----A---- C:\Windows\system32\NlsLexicons000c.dll
2009-08-27 12:09:30 ----A---- C:\Windows\system32\NlsLexicons0414.dll
2009-08-27 12:09:30 ----A---- C:\Windows\system32\NlsLexicons000f.dll
2009-08-27 12:09:29 ----A---- C:\Windows\system32\NlsLexicons0816.dll
2009-08-27 12:09:29 ----A---- C:\Windows\system32\NlsLexicons0416.dll
2009-08-27 12:09:28 ----A---- C:\Windows\system32\NlsModels0011.dll
2009-08-27 12:09:28 ----A---- C:\Windows\system32\NlsLexicons081a.dll
2009-08-27 12:09:27 ----A---- C:\Windows\system32\NlsData0047.dll
2009-08-27 12:09:27 ----A---- C:\Windows\system32\NlsData0046.dll
2009-08-27 12:09:27 ----A---- C:\Windows\system32\NlsData0045.dll
2009-08-27 12:09:26 ----A---- C:\Windows\system32\NlsData0049.dll
2009-08-27 12:09:26 ----A---- C:\Windows\system32\NlsData0039.dll
2009-08-27 12:09:25 ----A---- C:\Windows\system32\NlsData0021.dll
2009-08-27 12:09:25 ----A---- C:\Windows\system32\NlsData0020.dll
2009-08-27 12:09:24 ----A---- C:\Windows\system32\NlsData0024.dll
2009-08-27 12:09:24 ----A---- C:\Windows\system32\NlsData0022.dll
2009-08-27 12:09:23 ----A---- C:\Windows\system32\NlsData0026.dll
2009-08-27 12:09:22 ----A---- C:\Windows\system32\NlsData0027.dll
2009-08-27 12:09:22 ----A---- C:\Windows\system32\NlsData0010.dll
2009-08-27 12:09:21 ----A---- C:\Windows\system32\NlsData0011.dll
2009-08-27 12:09:20 ----A---- C:\Windows\system32\NlsData0019.dll
2009-08-27 12:09:20 ----A---- C:\Windows\system32\NlsData0018.dll
2009-08-27 12:09:20 ----A---- C:\Windows\system32\NlsData0013.dll
2009-08-27 12:09:20 ----A---- C:\Windows\system32\NlsData0000.dll
2009-08-27 12:09:19 ----A---- C:\Windows\system32\NlsData0003.dll
2009-08-27 12:09:19 ----A---- C:\Windows\system32\NlsData0002.dll
2009-08-27 12:09:19 ----A---- C:\Windows\system32\NlsData0001.dll
2009-08-27 12:09:18 ----A---- C:\Windows\system32\NlsData004b.dll
2009-08-27 12:09:18 ----A---- C:\Windows\system32\NlsData004a.dll
2009-08-27 12:09:18 ----A---- C:\Windows\system32\NlsData0009.dll
2009-08-27 12:09:18 ----A---- C:\Windows\system32\NlsData0007.dll
2009-08-27 12:09:17 ----A---- C:\Windows\system32\NlsData004e.dll
2009-08-27 12:09:17 ----A---- C:\Windows\system32\NlsData004c.dll
2009-08-27 12:09:17 ----A---- C:\Windows\system32\NlsData003e.dll
2009-08-27 12:09:17 ----A---- C:\Windows\system32\NlsData002a.dll
2009-08-27 12:09:16 ----A---- C:\Windows\system32\NlsData001b.dll
2009-08-27 12:09:16 ----A---- C:\Windows\system32\NlsData001a.dll
2009-08-27 12:09:15 ----A---- C:\Windows\system32\NlsData001d.dll
2009-08-27 12:09:14 ----A---- C:\Windows\system32\NlsData000a.dll
2009-08-27 12:09:13 ----A---- C:\Windows\system32\NlsData000d.dll
2009-08-27 12:09:13 ----A---- C:\Windows\system32\NlsData000c.dll
2009-08-27 12:09:12 ----A---- C:\Windows\system32\NlsData0414.dll
2009-08-27 12:09:12 ----A---- C:\Windows\system32\NlsData000f.dll
2009-08-27 12:09:11 ----A---- C:\Windows\system32\NlsData0416.dll
2009-08-27 12:09:10 ----A---- C:\Windows\system32\NlsData0816.dll
2009-08-27 12:09:10 ----A---- C:\Windows\system32\NaturalLanguage6.dll
2009-08-27 12:09:09 ----A---- C:\Windows\system32\NlsLexicons0c1a.dll
2009-08-27 12:09:09 ----A---- C:\Windows\system32\NlsData0c1a.dll
2009-08-27 12:09:09 ----A---- C:\Windows\system32\NlsData081a.dll
2009-08-27 12:02:35 ----A---- C:\Windows\system32\rpcss.dll
2009-08-27 12:02:34 ----A---- C:\Windows\system32\ntkrnlpa.exe
2009-08-27 12:02:33 ----A---- C:\Windows\system32\ntoskrnl.exe
2009-08-27 12:02:30 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe
2009-08-27 12:02:30 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll
2009-08-27 12:02:27 ----A---- C:\Windows\system32\iasdatastore.dll
2009-08-27 12:02:27 ----A---- C:\Windows\system32\iasads.dll
2009-08-27 12:02:26 ----A---- C:\Windows\system32\sdohlp.dll
2009-08-27 12:02:26 ----A---- C:\Windows\system32\iasrecst.dll
2009-08-27 11:35:40 ----D---- C:\Program Files\Free M4a to MP3 Converter
2009-08-27 11:35:19 ----A---- C:\Windows\system32\netfxperf.dll
2009-08-27 11:35:19 ----A---- C:\Windows\system32\dfshim.dll
2009-08-27 11:35:17 ----A---- C:\Windows\system32\mscoree.dll
2009-08-27 11:35:16 ----A---- C:\Windows\system32\mscories.dll
2009-08-27 11:35:16 ----A---- C:\Windows\system32\mscorier.dll
2009-08-27 11:30:28 ----A---- C:\Windows\system32\msvcr70.dll
2009-08-27 11:11:33 ----A---- C:\Windows\system32\rrinstaller.exe
2009-08-27 11:11:33 ----A---- C:\Windows\system32\mfps.dll
2009-08-27 11:11:33 ----A---- C:\Windows\system32\mfpmp.exe
2009-08-27 11:11:33 ----A---- C:\Windows\system32\mferror.dll
2009-08-27 11:11:33 ----A---- C:\Windows\system32\mf.dll
2009-08-27 11:11:32 ----A---- C:\Windows\system32\WMVCORE.DLL
2009-08-27 11:11:32 ----A---- C:\Windows\system32\WMNetMgr.dll
2009-08-27 11:11:32 ----A---- C:\Windows\system32\logagent.exe
2009-08-27 11:10:55 ----A---- C:\Windows\system32\INETRES.dll
2009-08-27 11:10:55 ----A---- C:\Windows\system32\inetcomm.dll
2009-08-27 11:09:47 ----A---- C:\Windows\system32\wmi.dll
2009-08-27 11:09:46 ----A---- C:\Windows\system32\imagehlp.dll
2009-08-27 11:09:34 ----A---- C:\Windows\system32\rpcrt4.dll
2009-08-27 11:09:19 ----A---- C:\Windows\system32\quartz.dll
2009-08-27 11:08:59 ----D---- C:\Program Files\MSXML 4.0
2009-08-27 11:08:51 ----A---- C:\Windows\system32\poqexec.exe
2009-08-27 11:07:06 ----A---- C:\Windows\system32\user32.dll
2009-08-27 11:06:54 ----A---- C:\Windows\system32\msxml6.dll
2009-08-27 11:06:53 ----A---- C:\Windows\system32\msxml6r.dll
2009-08-27 11:06:30 ----A---- C:\Windows\system32\qmgr.dll
2009-08-27 10:40:19 ----D---- C:\ProgramData\Avira
2009-08-27 10:40:19 ----D---- C:\Program Files\Avira
2009-08-27 02:04:57 ----D---- C:\Program Files\Trend Micro
2009-08-25 18:33:36 ----D---- C:\Users\Cosmina\AppData\Roaming\MozillaControl
2009-08-25 18:10:23 ----D---- C:\Program Files\coolspot AG
2009-08-25 18:01:23 ----D---- C:\Program Files\BS.Player ControlBar
2009-08-25 17:37:13 ----D---- C:\Program Files\CCleaner
2009-08-25 13:24:36 ----AD---- C:\ProgramData\TEMP
2009-08-25 12:14:39 ----D---- C:\ProgramData\273E3
2009-08-25 12:14:32 ----D---- C:\Program Files\BearShareTb
2009-08-25 12:12:23 ----D---- C:\Program Files\BearShare
2009-08-24 22:33:37 ----A---- C:\Windows\system32\np_plugin.dll
2009-08-24 11:18:01 ----D---- C:\Users\Cosmina\AppData\Roaming\DivX
2009-08-22 15:05:01 ----D---- C:\ProgramData\Sukoku
2009-08-22 15:05:01 ----D---- C:\Program Files\Sukoku
2009-08-22 12:22:23 ----D---- C:\Users\Cosmina\AppData\Roaming\NCH Software
2009-08-22 12:22:03 ----D---- C:\ProgramData\NCH Swift Sound
2009-08-22 12:20:10 ----D---- C:\Users\Cosmina\AppData\Roaming\Canneverbe_Limited
2009-08-22 12:20:09 ----D---- C:\ProgramData\Canneverbe Limited
2009-08-22 02:09:53 ----D---- C:\Program Files\MP3 WAV WMA Converter
2009-08-20 22:02:23 ----D---- C:\Program Files\Common Files\PX Storage Engine
2009-08-20 22:02:14 ----D---- C:\Program Files\DivX
2009-08-20 18:25:14 ----D---- C:\Program Files\VirtualDJ
2009-08-20 17:37:43 ----A---- C:\Windows\system32\javaws.exe
2009-08-20 17:37:43 ----A---- C:\Windows\system32\javaw.exe
2009-08-20 17:37:43 ----A---- C:\Windows\system32\java.exe
2009-08-20 17:37:43 ----A---- C:\Windows\system32\deploytk.dll
2009-08-20 17:37:25 ----D---- C:\Program Files\Java
2009-08-20 17:27:24 ----D---- C:\Users\Cosmina\AppData\Roaming\Ahead
2009-08-20 17:27:07 ----D---- C:\ProgramData\Ahead
2009-08-20 17:23:09 ----A---- C:\Windows\system32\d3dx9_30.dll
2009-08-20 17:23:08 ----A---- C:\Windows\system32\d3dx9_28.dll
2009-08-20 17:21:05 ----D---- C:\Program Files\AskTBar
2009-08-20 15:07:51 ----D---- C:\Program Files\GoldEsel
2009-08-20 15:07:50 ----D---- C:\Program Files\Ahead
2009-08-20 15:07:48 ----D---- C:\Program Files\Common Files\Ahead
2009-08-19 19:06:08 ----D---- C:\Users\Cosmina\AppData\Roaming\Real
2009-08-19 19:06:04 ----D---- C:\Users\Cosmina\AppData\Roaming\phonostar-Player
2009-08-19 19:06:03 ----D---- C:\Program Files\phonostar
2009-08-19 14:55:59 ----A---- C:\Windows\system32\d3dx9_35.dll
2009-08-19 14:55:59 ----A---- C:\Windows\system32\d3dx10_35.dll
2009-08-19 14:55:59 ----A---- C:\Windows\system32\D3DCompiler_35.dll
2009-08-19 14:55:58 ----A---- C:\Windows\system32\xinput1_3.dll
2009-08-19 14:53:28 ----D---- C:\Program Files\Metin2_RO
2009-08-19 14:30:50 ----D---- C:\Users\Cosmina\AppData\Roaming\DNA
2009-08-19 14:30:50 ----D---- C:\Program Files\GamersFirst
2009-08-19 14:30:50 ----D---- C:\Program Files\DNA
2009-08-15 19:14:25 ----D---- C:\Program Files\YouTube Downloader
2009-08-15 19:02:26 ----D---- C:\Program Files\Metin2_Germany
2009-08-15 18:43:23 ----D---- C:\Users\Cosmina\AppData\Roaming\skypePM
2009-08-15 18:42:55 ----D---- C:\Users\Cosmina\AppData\Roaming\Skype
2009-08-15 18:41:42 ----D---- C:\Program Files\Common Files\Skype
2009-08-15 18:41:41 ----RD---- C:\Program Files\Skype
2009-08-15 18:41:36 ----D---- C:\ProgramData\Skype

======List of files/folders modified in the last 1 months======

2009-08-29 15:34:10 ----D---- C:\Windows\Temp
2009-08-29 15:19:27 ----D---- C:\Windows\Prefetch
2009-08-29 15:18:55 ----SHD---- C:\System Volume Information
2009-08-29 15:18:51 ----D---- C:\Windows\System32
2009-08-29 15:18:51 ----D---- C:\Windows\inf
2009-08-29 15:18:51 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-08-29 15:16:23 ----HD---- C:\ProgramData
2009-08-29 15:16:10 ----SHD---- C:\Windows\Installer
2009-08-29 15:16:05 ----RD---- C:\Program Files
2009-08-29 15:15:34 ----D---- C:\Program Files\Common Files
2009-08-29 15:11:34 ----D---- C:\Program Files\BS_Player
2009-08-29 14:56:32 ----D---- C:\Windows
2009-08-29 14:56:28 ----D---- C:\Windows\system32\drivers
2009-08-29 14:05:59 ----D---- C:\Program Files\Mozilla Firefox
2009-08-28 23:14:01 ----D---- C:\Windows\system32\Tasks
2009-08-28 22:26:15 ----D---- C:\Users\Cosmina\AppData\Roaming\BSplayer
2009-08-28 18:55:16 ----D---- C:\Windows\system32\LogFiles
2009-08-28 18:55:09 ----D---- C:\Windows\Debug
2009-08-27 17:13:43 ----D---- C:\Windows\Microsoft.NET
2009-08-27 17:13:39 ----RSD---- C:\Windows\assembly
2009-08-27 17:03:41 ----D---- C:\Windows\system32\en-US
2009-08-27 17:03:36 ----SHD---- C:\Boot
2009-08-27 17:02:40 ----ASH---- C:\Program Files\desktop.ini
2009-08-27 17:02:35 ----D---- C:\Windows\rescache
2009-08-27 16:59:45 ----D---- C:\Windows\servicing
2009-08-27 16:59:44 ----D---- C:\Program Files\Windows Mail
2009-08-27 16:59:44 ----D---- C:\Program Files\Common Files\System
2009-08-27 16:59:43 ----D---- C:\Windows\system32\migration
2009-08-27 16:59:42 ----D---- C:\Windows\system32\wbem
2009-08-27 16:59:39 ----D---- C:\Windows\winsxs
2009-08-27 12:31:25 ----D---- C:\Windows\system32\catroot
2009-08-27 12:04:47 ----D---- C:\Windows\system32\catroot2
2009-08-27 11:32:09 ----SD---- C:\Users\Cosmina\AppData\Roaming\Microsoft
2009-08-27 11:06:42 ----D---- C:\Windows\SoftwareDistribution
2009-08-27 10:34:05 ----D---- C:\Windows\Logs
2009-08-27 02:04:34 ----D---- C:\Windows\ehome
2009-08-26 18:31:54 ----RSD---- C:\Windows\Fonts
2009-08-25 17:37:30 ----D---- C:\Windows\Minidump
2009-08-22 15:05:05 ----A---- C:\Windows\win.ini
2009-08-22 15:04:24 ----D---- C:\ProgramData\Yahoo! Companion
2009-08-20 17:21:03 ----D---- C:\temp
2009-08-20 15:07:48 ----HD---- C:\Program Files\InstallShield Installation Information
2009-08-14 15:40:44 ----D---- C:\Windows\tracing

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2006-11-02 319488]
R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-08-05 9968]
R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2009-08-05 74480]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys [2009-07-06 5632]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 AtcL001;NDIS Miniport Driver for Atheros L1 Gigabit Ethernet Controller; C:\Windows\system32\DRIVERS\l160x86.sys [2007-12-17 46592]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2007-09-28 3154944]
R3 CAM1210;USB video camera; C:\Windows\System32\Drivers\cam1210.sys [2007-02-14 92416]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-10-02 1967576]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [2006-10-19 7680]
R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2009-08-05 7408]
S1 ASPI32;ASPI32; C:\Windows\system32\drivers\ASPI32.sys []
S2 TESTCAP;Virtual Human Interface Video Capture 0; C:\Windows\system32\DRIVERS\testcap.sys []
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 E100B;Intel(R) PRO Adapter Driver; C:\Windows\system32\DRIVERS\e100b325.sys [2006-11-02 163328]
S3 EagleNT;EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys []
S3 FETNDIS;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\Windows\system32\DRIVERS\fetnd5.sys [2006-11-02 45568]
S3 GETNDIS;VIA Networking Velocity Family Gigabit Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\getnd6.sys [2006-11-02 38912]
S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvm60x32.sys [2006-11-02 429056]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2006-11-02 44544]
S3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver; C:\Windows\system32\DRIVERS\RTL85n86.sys [2006-11-02 311808]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2008-02-22 87936]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2008-02-22 14976]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2008-02-22 114304]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2007-09-28 610304]
R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 lxcz_device;lxcz_device; C:\Windows\system32\lxczcoms.exe [2007-04-19 537520]
R2 Sukoku Service;Sukoku Service; C:\ProgramData\Sukoku\sukoku115.exe [2009-08-25 54760]
S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2006-11-02 521216]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe []
S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2006-11-02 22016]
S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2006-11-02 562176]

-----------------EOF-----------------

Das ist alles was bei RSIT rauskam ... :( Die Superspyware is noch am suchen.

Seit wann hast du denn das Problem?

ciao, andreas

Ehrlich gesagt erst seit en paar Tage. Dachte es waere nix ernstest aber dann fing es an zu nerven... scheint jetz weg zu sein .. also pop up frei und inet speed deutlich besser... bin mir aber nicht sicher das die weg sind .. was meinst du ?:confused:

SUPERAntiSpyware Scann-Protokoll
http://www.superantispyware.com

Generiert 08/29/2009 bei 03:59 PM

Version der Applikation : 4.27.1002

Version der Kern-Datenbank : 4076
Version der Spur-Datenbank : 2016

Scan Art : kompletter Scann
Totale Scann-Zeit : 00:40:28

Gescannte Speicherelemente : 728
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 5822
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 80360
Erfasste Datei-Elemente : 0

hier der letzte scan .. was is noch zu machen ?:applaus:

Soooo genau wollte ich das gar nicht wissen. Geht das etwas genauer?

Hast du dir das hier freiwillig installiert?
Du hast noch einen O9-Eintrag beim Fixen übersehen.

Es fehlt auch noch die info.txt von RSIT.

Start => Ausführen => c:\rsit\info.txt => OK

ciao, andreas

xD sagen wir vor 4 tage xD ahm wo genau bei vista is den AUsfuhren ... ja und ich fix den eintrag jetzt:schmoll:

Bearshare ist eine Virenschleuder und dazu sehr häufig mit Adware verseucht. Die anderen sehen auch verdächtig aus.

SuperAntiSpyware kannst du wieder deinstallieren.

ciao, andreas

Ja weg damit. Sag mir aber bitte wie.

info.txt logfile of random's system information tool 1.06 2009-08-29 15:02:13

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1 - Romanian-->MsiExec.exe /I{AC76BA86-7AD7-1048-7B44-A91000000001}
Ask Toolbar-->rundll32 C:\PROGRA~1\AskTBar\bar\1.bin\AskTBar.dll,O
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
BS.Player ControlBar-->C:\Program Files\BS.Player ControlBar\uninst.exe
BS.Player FREE-->"C:\Program Files\Webteh\BSplayer\uninstall.exe"
BS_Player Toolbar-->C:\PROGRA~1\BS_PLA~1\UNWISE.EXE /U C:\PROGRA~1\BS_PLA~1\INSTALL.LOG
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Defraggler (remove only)-->"C:\Program Files\Defraggler\uninst.exe"
Express Burn-->C:\Program Files\NCH Swift Sound\ExpressBurn\uninst.exe
Free M4a to MP3 Converter 6.0-->"C:\Program Files\Free M4a to MP3 Converter\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216015FF}
Lexmark 1200 Series-->C:\Program Files\Lexmark 1200 Series\Install\x86\Uninst.exe
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MediaBar-->C:\Program Files\BearShareTb\uninstall.exe
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.2)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
Nero 6 Reloaded PlugIn Pack v2.0.6 Final - WWW.GOLDESEL.TO-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{87814A0A-92AA-4E61-94F8-0245BF5FA8E4}\setup.exe" -l0x7 -removeonly
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
phonostar-Player Version 2.01.5-->"C:\Program Files\phonostar\unins000.exe"
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe
SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x0009 -removeonly
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Sukoku 1.0 build 115-->C:\Program Files\Sukoku\uninstall.exe
USB Video Camera Driver v1.52-->MsiExec.exe /I{E819CB61-79E9-4D84-AEA9-2C9207CA481D}
Vista Codec Package-->MsiExec.exe /I{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: AntiVir Desktop
AS: AntiVir Desktop
AS: Windows Defender

======System event log======

Computer Name: ***-PC
Event Code: 1002
Message: The IP address lease 10.10.204.92 for the Network Card with network address 0023541B467C has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
Record Number: 31088
Source Name: Microsoft-Windows-Dhcp-Client
Time Written: 20090829115637.000000-000
Event Type: Error
User:

Computer Name: ****-PC
Event Code: 7000
Message: The Virtual Human Interface Video Capture 0 service failed to start due to the following error:
The system cannot find the file specified.
Record Number: 31148
Source Name: Service Control Manager
Time Written: 20090829115825.000000-000
Event Type: Error
User:

Computer Name: ****-PC
Event Code: 7026
Message: The following boot-start or system-start driver(s) failed to load:
ASPI32
Record Number: 31168
Source Name: Service Control Manager
Time Written: 20090829115825.000000-000
Event Type: Error
User:

Computer Name: ****-PC
Event Code: 4
Message: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable.
Record Number: 31181
Source Name: Microsoft-Windows-SpoolerWin32SPL
Time Written: 20090829120039.000000-000
Event Type: Warning
User:

Computer Name: ****-PC
Event Code: 4
Message: The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key S-1-5-18\Printers\Connections. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable.
Record Number: 31182
Source Name: Microsoft-Windows-SpoolerWin32SPL
Time Written: 20090829120039.000000-000
Event Type: Warning
User:

=====Application event log=====

Computer Name: ****-PC
Event Code: 4113
Message: AntiVir has detected 'W32/Expiro.B' in the file D:\filme\LimeWire\LimeWire.exe
Record Number: 5781
Source Name: Avira AntiVir
Time Written: 20090829115240.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: ****-PC
Event Code: 4113
Message: AntiVir has detected 'W32/Expiro.B' in the file D:\PhotoScape\PhotoScape.exe
Record Number: 5782
Source Name: Avira AntiVir
Time Written: 20090829115329.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: ****-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3289896095-1089425117-1401572969-1000:
Process 968 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3289896095-1089425117-1401572969-1000

Record Number: 5787
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090829115526.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: ****-PC
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-3289896095-1089425117-1401572969-1000_Classes:
Process 968 (\Device\HarddiskVolume1\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3289896095-1089425117-1401572969-1000_CLASSES

Record Number: 5788
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090829115527.000000-000
Event Type: Warning
User: NT AUTHORITY\SYSTEM

Computer Name: ****-PC
Event Code: 1000
Message: Faulting application firefox.exe, version 1.9.1.3497, time stamp 0x4a7148bb, faulting module NPComponent.dll, version 1.0.0.3804, time stamp 0x4a5d6723, exception code 0xc0000005, fault offset 0x0000b431, process id 0xa80, application start time 0x01ca289ff2e52c4f.
Record Number: 5814
Source Name: Application Error
Time Written: 20090829115811.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: ****-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: ****-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x290
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 8611
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090829115649.753691-000
Event Type: Audit Success
User:

Computer Name: ****-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 8612
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090829115649.753691-000
Event Type: Audit Success
User:

Computer Name: ****-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: ****-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x290
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 8613
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090829115950.126491-000
Event Type: Audit Success
User:

Computer Name: ****-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: ****-PC$
Account Domain: WORKGROUP
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x290
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 8614
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090829115950.126491-000
Event Type: Audit Success
User:

Computer Name: ****-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 8615
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090829115950.126491-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Samsung\Samsung PC Studio 3\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------

Hier die restiliche Info..:singsing:

Die Programme habe ich manuell normal desinstalliert. Wie kann ich sicher sein das keine Dateileichen mehr da sind ???

1.) Deinstalliere:

• Ask Toolbar
• BS_Player Toolbar
• MediaBar
• Yahoo! Toolbar

2.) Schnappe dir eine Packung Kreide und schreibe einhundertmal an die Tafel: Ich werde keine Toolbars mehr installieren! :aufsmaul:

3.) Dafür gibt es Schläge. Niemals - gar nie nicht - dort irgendetwas laden. Du kannst dir direkt schenken, dass bei Virustotal auswerten zu lassen, dass ist sowieso alles verseucht.
4.) Wische die Tafel wieder ab und schreibe einhundertmal an die Tafel: Ich werde nichts mehr von Goldesel laden! :aufsmaul:

Du bist entlassen. :)

ciao, andreas

Ich danke dir aus ganzen Herzen,

Also nur die Toolbars deinstalieren ?

Ja. :)

ciao, andreas

Vielen Dank.