|
BDS/Agent.AY und TR/PSW.Banpaes.2 Hallo Ihr, ich kenne mich nicht sonderlich aus am PC und brauche deshalb Eure Hilfe. Gestern fand mein Antivir: BDS/Agent.AY. Nachdem ich hier etwas nachgelesen habe (leider aber nur die Hälfte was man tun soll verstanden), habe ich mir Hijackthis- v1.99.1 und Spybot Search and Destroy... runtergeladen und durchlaufen lassen. Nun findet mein Antivir heute den Virus TR/PSW.Banpaes.2. Was soll ich genau tun?? Bitte ganz einfach beschreiben, da ich mich wirklich nicht auskenne. Vielen DANK!! Su09 ps. hier mal meine LogFile (das hab ich grad noch so hinbekommen) Logfile of HijackThis v1.99.1 Scan saved at 13:54:51, on 07.03.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\T-DSL Business\bolog.exe C:\Programme\T-DSL SpeedManager\SpeedMgr.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\QuickTime\qttask.exe C:\WINDOWS\Dit.exe C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe C:\Programme\AVPersonal\AVGNT.EXE C:\WINDOWS\DitExp.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\T-DSL SpeedManager\tsmsvc.exe C:\WINDOWS\system32\devldr32.exe C:\Programme\T-DSL Business\BODialer.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Administrator\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.t-online.de/software/ie401/search.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.t-online.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\Programme\INSTAFINK\instafink.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BusinessOnline Log] "C:\Programme\T-DSL Business\bolog.exe" O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe" O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1102701449809 O17 - HKLM\System\CCS\Services\Tcpip\..\{50D95A0E-6C5F-4142-ACA9-AE4049DC71C6}: NameServer = 217.237.151.161 217.237.151.33 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe |
Hallo su09, führe bitte dies mal aus: 1. Downloade Dir escan und befolge genau diese Anleitung (dauert etwa eine Stunde), 2. starte nach dem Scan wieder in den normalen Modus, 3. öffne die Datei "mwav.log", klicke auf "bearbeiten" danach auf "suchen" 4. gebe dann "infected" ein, 5. suche weiter bei Treffern, markiere diese und kopiere sie ins Forum, 6. neben den Treffern auch das Gesamtergebnis (befindet sich ganz unter im Logfile) posten. Beispiel: Wed Feb 02 19:48:56 2005 => Total Files Scanned: Wed Feb 02 19:48:56 2005 => Total Virus(es) Found: . . . . dartus |
Hallo, @dartus: erst mal danke für deine Antwort. Also hab das escan durchlaufen lassen im abgesicherten Modus - ging ewig. Hat aber einiges gefunden. Nicht erschrecken: File C:\Programme\INSTAFINK\instafink.dll infected by "not-a-virus:AdWare.ToolBar.404Search.h" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\Content.IE5\8DYV8LEN\prompt[1].php infected by "Trojan-Downloader.JS.WinAD.a" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\ADMINI~1\LOKALE~1\TEMPOR~1\Content.IE5\VQ58TRR7\bridge-c46[1].cab infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\8DYV8LEN\prompt[1].php infected by "Trojan-Downloader.JS.WinAD.a" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\VQ58TRR7\bridge-c46[1].cab infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\1.bin\MY2NS.EXE infected by "not-a-virus:AdWare.Toolbar.MyWay.b" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\1.bin\NPMYWAY.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020426.dll infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020432.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020433.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020434.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020438.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP60\A0020441.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020914.dll infected by "not-a-virus:AdWare.Altnet.d" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020932.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020933.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020934.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020935.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020936.dll infected by "not-a-virus:AdWare.Gator.3124" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020937.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020938.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020939.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020940.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020941.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020942.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020943.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020946.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020948.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020949.dll infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020950.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0020951.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP63\A0021016.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\Setup.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File D:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP18\A0007696.exe tagged as not-a-virus:RiskWare.Tool.AIDA.3862. No Action Taken. File D:\System Volume Information\_restore{EA0353BC-CC91-428E-9ABE-DB7A9763B0BF}\RP18\A0007702.dll tagged as not-a-virus:RiskWare.Tool.AIDA.3862. No Action Taken. Und hier mal das Gesamtergebnis: Tue Mar 08 18:46:06 2005 => Total Files Scanned: 256382 Tue Mar 08 18:46:06 2005 => Total Virus(es) Found: 43 Tue Mar 08 18:46:06 2005 => Total Disinfected Files: 0 Tue Mar 08 18:46:06 2005 => Total Files Renamed: 0 Tue Mar 08 18:46:06 2005 => Total Deleted Files: 0 Tue Mar 08 18:46:06 2005 => Total Errors: 3 Tue Mar 08 18:46:06 2005 => Time Elapsed: 04:10:32 Tue Mar 08 18:46:06 2005 => Virus Database Date: 2005/03/07 Tue Mar 08 18:46:06 2005 => Virus Database Count: 120659 Ich habe mal angefangen diese 43 Dateien zu suchen, um zu löschen, aber da werd ich ja wahnsinnig. Bleibt mir nichts anderes übrig?? :( DANKE Su09 |
doch! lade dir spybot 1.3 http://www.safer-networking.org/de/download/index.html update es und scanne den pc noch immunisieren und neues escan log posten |
Hallo su09, lade Dir clearprog 1.4.1 final. Wechsel in den abgesicherten Modus bei deaktivierter Systemwiederherstellung (damit gehen diese Einträge weg: C:\System Volume Information\_restore) http://www.systemwiederherstellung-d...indows-xp.html Starte clearprog --->alles löschen "Häckchen"-->löschen (alle Temp-Ordner geleert) Folgende Ordner löschen: C:\Programme\INSTAFINK C:\Programme\MyWay Lass noch mal spybot laufen, bei Funden alles löschen. Neustart-->Systemwiederherstellung aktivieren ... und ein neues HJT-Logfile dartus P.S. Benutze zum Surfen NICHT mehr den IExplorer nur noch zum Updaten hier Empfehlungen -->http://www.trojaner-board.de/showthread.php?t=8251 |
Hallo, vielen Dank nochmal für Eure Hilfe. Echt toll dieses Forum! Habe alles soweit ausgeführt und Spybot hat keine Spione mehr gefunden. :huepp: Hier mein Logfile: Logfile of HijackThis v1.99.1 Scan saved at 12:54:29, on 09.03.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\T-DSL Business\bolog.exe C:\Programme\T-DSL SpeedManager\SpeedMgr.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\QuickTime\qttask.exe C:\WINDOWS\Dit.exe C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe C:\Programme\AVPersonal\AVGNT.EXE C:\WINDOWS\system32\ctfmon.exe C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\WINDOWS\DitExp.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\T-DSL SpeedManager\tsmsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Dokumente und Einstellungen\Administrator\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.t-online.de/software/ie401/search.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.t-online.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\Programme\INSTAFINK\instafink.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BusinessOnline Log] "C:\Programme\T-DSL Business\bolog.exe" O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe" O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_06\bin\npjpi142_06.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1102701449809 O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe Ist jetzt alles wieder OK??? Wie kann ich mich weiterhin schützen? Außer dass ich nicht mehr IE benutze? LG Su09 |
O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\Programme\INSTAFINK\instafink.dll (file missing) O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (file missing) diese beiden Einträge solltest Du noch im abgesicherten Modus fixen, ansonsten kann ich nicht's mehr erkennen Zitat:
|
Sorry, aber wo soll ich die fixen? Kenn mich leider nicht so aus. Abgesicherter Modus ist klar... aber dann??? Sorry, Su09 |
Anleitung hier |
VIELEN DANK! Su09 |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 18:08 Uhr. |
Copyright ©2000-2025, Trojaner-Board