Trojaner-Board - Mein Logfile

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Mein Logfile (https://www.trojaner-board.de/7914-logfile.html)

Hallo Leutz.

Ich hoffe ihr könnt mir helfen.
Mein I-explorer funktioniert nimma.
Wollt gestern neue updates saugen und dann hats einfach nicht mehr funktioniert.

hier mein Startup-log

Code:



StartupList report, 27.09.2004, 22:32:52

StartupList version: 1.52.2

Started from : C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.907\HijackThis.EXE

Detected: Windows XP SP1 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================
 

Running processes:
 

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe

C:\Programme\Norton Internet Security\NISUM.EXE

C:\Programme\Norton Internet Security\ccPxySvc.exe

C:\Programme\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RUNDLL32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Analog Devices\SoundMAX\SMTray.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe

C:\Programme\Logitech\iTouch\iTouch.exe

C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe

C:\Programme\Common files\updater\wupdater.exe

C:\WINDOWS\System32\SahAgent.exe

C:\Programme\Gemeinsame Dateien\GMT\GMT.exe

C:\Programme\ZMatrix\matrix.exe

C:\WINDOWS\system32\ntvdm.exe

C:\T-ONLINE\BSW4\ToDuCAlC.EXE

C:\Programme\ICQLite\ICQLite.exe

G:\Tools\Teamspeak\TeamSpeak.exe

C:\PROGRA~1\MOZILLA.ORG\MOZILLA\MOZILLA.EXE

C:\Programme\WinRAR\WinRAR.exe

C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.907\HijackThis.exe

C:\Programme\Messenger\msmsgs.exe

C:\WINDOWS\system32\NOTEPAD.EXE
 

--------------------------------------------------
 

Listing of startup folders:
 

Shell folders Startup:

[C:\Dokumente und Einstellungen\Robert\Startmenü\Programme\Autostart]

ZMatrix.lnk = C:\Programme\ZMatrix\matrix.exe
 

Shell folders Common Startup:

[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]

GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe

Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
 

--------------------------------------------------
 

Checking Windows NT UserInit:
 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

SoundMan = SOUNDMAN.EXE

Smapp = C:\Programme\Analog Devices\SoundMAX\SMTray.exe

NeroCheck = C:\WINDOWS\System32\\NeroCheck.exe

ccApp = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"

ccRegVfy = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"

zBrowser Launcher = C:\Programme\Logitech\iTouch\iTouch.exe

SunJavaUpdateSched = C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

QuickTime Task = "C:\Programme\QuickTime\qttask.exe" -atboottime

CMESys = "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe"

EM_EXEC = C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

updater = C:\Programme\Common files\updater\wupdater.exe

SAHAgent = C:\WINDOWS\System32\SahAgent.exe
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 

Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
 

ICQ Lite = C:\Programme\ICQLite\ICQLite.exe -trayboot
 

--------------------------------------------------
 

Load/Run keys from C:\WINDOWS\WIN.INI:
 

load=

run= G:\LOL\ICONS95.EXE
 

Load/Run keys from Registry:
 

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
 

--------------------------------------------------
 

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*
 

Shell & screensaver key from Registry:
 

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*
 

Policies Shell key:
 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*
 

--------------------------------------------------
 
 

Enumerating Browser Helper Objects:
 

(no name) - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

NavErrRedir Class - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL - {5D60FF48-95BE-4956-B4C6-6BB168A70310}

NAV Helper - C:\Programme\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
 

--------------------------------------------------
 

Enumerating Task Scheduler jobs:
 

Norton AntiVirus - Meinen Computer prüfen.job

Symantec NetDetect.job
 

--------------------------------------------------
 

Enumerating Download Program Files:
 

[{33564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://download.microsoft.com/downlo...22/wmv9VCM.CAB
 

[WUWebControl Class]

InProcServer32 = C:\WINDOWS\System32\wuweb.dll

CODEBASE = http://v5.windowsupdate.microsoft.co...?1095956636015
 

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]

CODEBASE = http://v4.windowsupdate.microsoft.co...206.7052314815
 

--------------------------------------------------
 

Enumerating Winsock LSP files:
 

Protocol #16: xfire_lsp_8742.dll (file MISSING)

Protocol #17: xfire_lsp_8742.dll (file MISSING)

Protocol #18: xfire_lsp_8742.dll (file MISSING)

Protocol #19: xfire_lsp_8742.dll (file MISSING)

Protocol #20: xfire_lsp_8742.dll (file MISSING)

Protocol #36: xfire_lsp_8742.dll (file MISSING)
 

--------------------------------------------------
 

Enumerating Windows NT logon/logoff scripts:

*No scripts set to run*
 

Windows NT checkdisk command:

BootExecute = autocheck autochk *
 

Windows NT 'Wininit.ini':

PendingFileRenameOperations: C:\Programme\Xfire\23.exe||C:\Programme\Xfire\xfire_conure_9028.dll|||r
 

--------------------------------------------------
 

Enumerating ShellServiceObjectDelayLoad items:
 

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\System32\webcheck.dll

SysTray: C:\WINDOWS\System32\stobject.dll
 

--------------------------------------------------

End of report, 8.304 bytes

Report generated in 0,047 seconds
 

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only

Thx for help

Besorge dir:
http://www.cexx.org/lspfix.htm

das Programm sollte dein Problem mit der Winsock lösen, so dass du erst mal wieder ins Netz kommst. Desweiteren sind da einige Spyware-Sachen drauf, erstelle mal noch ein Log mit HJT:

http://www.trojaner-board.de/51130-a...ijackthis.html

Als meinI-Explorer funzt immer noch nicht.
Hab ja eigentlich Mozilla.
Will aber meine Win updates mit I-explorerziehen.

Hier das log des anderen scans.
Ein freund sagte, das der StartUpScan reicht

naja, nochmal danke im Vorraus

Code:

Logfile of HijackThis v1.98.2

Scan saved at 19:09:53, on 28.09.2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe

C:\Programme\Norton Internet Security\NISUM.EXE

C:\Programme\Norton Internet Security\ccPxySvc.exe

C:\Programme\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RUNDLL32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Analog Devices\SoundMAX\SMTray.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe

C:\Programme\Logitech\iTouch\iTouch.exe

C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe

C:\Programme\Common files\updater\wupdater.exe

C:\WINDOWS\System32\SahAgent.exe

C:\Programme\Gemeinsame Dateien\GMT\GMT.exe

C:\Programme\ZMatrix\matrix.exe

C:\Programme\Winamp\winamp.exe

C:\WINDOWS\system32\ntvdm.exe

C:\T-ONLINE\BSW4\ToDuCAlC.EXE

C:\PROGRA~1\mozilla.org\Mozilla\mozilla.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\WinRAR\WinRAR.exe

C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.453\HijackThis.exe
 

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL

F1 - win.ini: run= G:\LOL\ICONS95.EXE

O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [CMESys] "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe"

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [updater] C:\Programme\Common files\updater\wupdater.exe

O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\System32\SahAgent.exe

O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - Startup: ZMatrix.lnk = C:\Programme\ZMatrix\matrix.exe

O4 - Global Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1095956636015

O17 - HKLM\System\CCS\Services\Tcpip\..\{E0D88B7A-E45C-4959-909A-9C12ACCAF225}: NameServer = 217.237.151.97 217.237.150.33

Spybot
und Das eScan AV Toolkit (mwav.exe) herunterladen, die Datei in den Ordner "c:\Bases" (wichtig !) entpacken und danach die "kavupd.exe" (Update) ausführen.
Abgesicherter Modus und den Scanner mit der "mwavscan.com" starten. Alle Häkchen setzen und "Scan clean" klicken.
http://www.mwti.net/antivirus/free_utilities.asp

Danach die Virus Log Information und ein neues Log-File posten.

Normale Logfile

Code:

Logfile of HijackThis v1.98.2

Scan saved at 23:55:55, on 29.09.2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe

C:\Programme\Norton Internet Security\NISUM.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RUNDLL32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Analog Devices\SoundMAX\SMTray.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe

C:\Programme\Logitech\iTouch\iTouch.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Norton Internet Security\ccPxySvc.exe

C:\Programme\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

G:\Tools\Teamspeak\TeamSpeak.exe

C:\WINDOWS\system32\ntvdm.exe
 

C:\T-ONLINE\BSW4\ToDuCAlC.EXE

C:\Programme\mozilla.org\Mozilla\mozilla.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\WinRAR\WinRAR.exe

C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.484\HijackThis.exe
 

F1 - win.ini: run= G:\LOL\ICONS95.EXE

O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - Startup: ZMatrix.lnk = C:\Programme\ZMatrix\matrix.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1095956636015

O17 - HKLM\System\CCS\Services\Tcpip\..\{E0D88B7A-E45C-4959-909A-9C12ACCAF225}: NameServer = 217.237.151.97 217.237.150.33

StartupLog

Code:

StartupList report, 29.09.2004, 23:56:02

StartupList version: 1.52.2

Started from : C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.484\HijackThis.EXE

Detected: Windows XP SP1 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================
 

Running processes:
 

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe

C:\Programme\Norton Internet Security\NISUM.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RUNDLL32.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programme\Analog Devices\SoundMAX\SMTray.exe

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe

C:\Programme\Logitech\iTouch\iTouch.exe

C:\Programme\QuickTime\qttask.exe

C:\Programme\Norton Internet Security\ccPxySvc.exe

C:\Programme\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

G:\Tools\Teamspeak\TeamSpeak.exe

C:\WINDOWS\system32\ntvdm.exe

C:\T-ONLINE\BSW4\ToDuCAlC.EXE

C:\Programme\mozilla.org\Mozilla\mozilla.exe

C:\Programme\Messenger\msmsgs.exe

C:\Programme\WinRAR\WinRAR.exe

C:\DOKUME~1\Robert\LOKALE~1\Temp\Rar$EX00.484\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE
 

--------------------------------------------------
 

Listing of startup folders:
 

Shell folders Startup:

[C:\Dokumente und Einstellungen\Robert\Startmenü\Programme\Autostart]

ZMatrix.lnk = C:\Programme\ZMatrix\matrix.exe
 

Shell folders Common Startup:

[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]

Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
 

--------------------------------------------------
 

Checking Windows NT UserInit:
 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,
 

--------------------------------------------------
 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

nwiz = nwiz.exe /install

NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

SoundMan = SOUNDMAN.EXE

Smapp = C:\Programme\Analog Devices\SoundMAX\SMTray.exe

NeroCheck = C:\WINDOWS\System32\\NeroCheck.exe

ccApp = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"

ccRegVfy = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"

zBrowser Launcher = C:\Programme\Logitech\iTouch\iTouch.exe

SunJavaUpdateSched = C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe

QuickTime Task = "C:\Programme\QuickTime\qttask.exe" -atboottime

EM_EXEC = C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
 

--------------------------------------------------
 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 

Symantec NetDriver Monitor = C:\PROGRA~1\SYMNET~1\SNDMon.exe
 

--------------------------------------------------
 

Load/Run keys from C:\WINDOWS\WIN.INI:
 

load=

run= G:\LOL\ICONS95.EXE
 

Load/Run keys from Registry:
 

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*

HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*

HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*

HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*

HKCU\..\Windows NT\CurrentVersion\Windows: load=

HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*

HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
 

--------------------------------------------------
 

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*
 

Shell & screensaver key from Registry:
 

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*
 

Policies Shell key:
 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*
 

--------------------------------------------------
 
 

Enumerating Browser Helper Objects:
 

(no name) - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

NAV Helper - C:\Programme\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
 

--------------------------------------------------
 

Enumerating Task Scheduler jobs:
 

Norton AntiVirus - Meinen Computer prüfen.job

Symantec NetDetect.job
 

--------------------------------------------------
 

Enumerating Download Program Files:
 

[{33564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://download.microsoft.com/downlo...22/wmv9VCM.CAB
 

[WUWebControl Class]

InProcServer32 = C:\WINDOWS\System32\wuweb.dll

CODEBASE = http://v5.windowsupdate.microsoft.co...?1095956636015
 

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]

CODEBASE = http://v4.windowsupdate.microsoft.co...206.7052314815
 

--------------------------------------------------
 

Enumerating ShellServiceObjectDelayLoad items:
 

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\System32\webcheck.dll

SysTray: C:\WINDOWS\System32\stobject.dll
 

--------------------------------------------------

End of report, 6.821 bytes

Report generated in 0,078 seconds
 

Command line options:

   /verbose  - to add additional info on each section

   /complete - to include empty sections and unsuspicious data

   /full     - to include several rarely-important sections

   /force9x  - to include Win9x-only startups even if running on WinNT

   /forcent  - to include WinNT-only startups even if running on Win9x

   /forceall - to include all Win9x and WinNT startups, regardless of platform

   /history  - to list version history only