|
Internet Explorer öffnet immer Werbefenster! Hallo, ich habe ein problem, wenn ich ins i-net gehe, dann öffnen sich immer von selbst diverse werbefenster. ich habe das problem von anderen auch gesehen, aber bei mir kann ich die fehler nicht finden. hier mein HiJackThis_Log-File: Logfile of Trend Micro Hijack.This v2.0.2 Scan saved at 20:05:47, on 21.05.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Windows\System32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\AxBx\VirusKeeper 2008 Pro Probeversion\VirusKeeper.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Pinnacle\Shared Files\Programs\Remote\remoterm.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Users\***\Programme\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Probeversion\VirusKeeper.exe O4 - HKLM\..\Run: [VaCtrl] C:\Program Files\VoiceAge\Common\VaCtrl.exe O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\Reto\Program Files\DNA\btdna.exe" O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: APSHook.dll O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10745 bytes ______________ kann mir da jemand helfen? wäre euch sehr dankbar mfg sheppard91 |
Hi, ich vermute dieser Eintrag verantwortlich ist: Zitat:
Wechsele in den abgesicherten Modus und lösche die Datei Zitat:
Zitat:
Wechsele danach in den normalen Modus und erstelle ein neues Hijackthislog und poste es hier. Berichte ob sich an der Werbung etwas geändert hat. lg myrtille |
ich habe deine anweisungen befolgt. hier mein Logfile: Logfile of Trend Micro Hijack.This v2.0.2 Scan saved at 18:34:31, on 22.05.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe C:\Windows\System32\rundll32.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\AxBx\VirusKeeper 2008 Pro Probeversion\VirusKeeper.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Pinnacle\Shared Files\Programs\Remote\remoterm.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Users\***\Programme\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url=h*tp://go.microsoft.com/fwlink/?LinkId=54896]Live Search[/*url] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url=h*tp://www.google.ch/]Google[/*url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url=h*tp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop]meinAOL | HP[/*url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url=h*tp://go.microsoft.com/fwlink/?LinkId=54896]Live Search[/*url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url=h*tp://go.microsoft.com/fwlink/?LinkId=54896]Live Search[/*url] R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url=h*tp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_CH&c=73&bd=Pavilion&pf=laptop]meinAOL | HP[/*url] R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [VirusKeeper] C:\Program Files\AxBx\VirusKeeper 2008 Pro Probeversion\VirusKeeper.exe O4 - HKLM\..\Run: [VaCtrl] C:\Program Files\VoiceAge\Common\VaCtrl.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [PMCRemote] C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - [url=h*tp://favorites.live.com/quickadd.aspx]Add to Windows Live Favorites[/*url] O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in &Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - [url]h*tp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab[/*url] O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL O20 - AppInit_DLLs: APSHook.dll O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10498 bytes ich habe das ganze Bittorrent gelöscht, das geht bei mir nicht, weil die ports nicht frei sind ich danke dir vielmals, aber das problem ist noch nicht weg, da kommen immer noch diese werbefenster mfg sheppard91 |
Hi, dann arbeite bitte mal folgende Anleitung ab: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten. lg myrtille |
so habs geschaft, hier der bericht von combofix: ComboFix 08-05-21.3 - Reto 2008-05-24 18:37:26.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1170 [GMT 2:00] ausgeführt von:: C:\Users\Reto\Desktop\ComboFix.exe * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere L”schungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Users\Reto\AppData\Local\hddecau.dat C:\Users\Reto\AppData\Local\hddecau.exe C:\Users\Reto\AppData\Local\hddecau_nav.dat C:\Users\Reto\AppData\Local\hddecau_navps.dat C:\Windows\system32\MSINET.oca C:\Windows\system32\nvs2.inf . ((((((((((((((((((((((( Dateien erstellt von 2008-04-24 bis 2008-05-24 )))))))))))))))))))))))))))))) . Keine neuen Dateien erstellt in diesem Zeitraum . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-24 16:25 --------- d-----w C:\Program Files\CCleaner 2008-05-24 16:08 --------- d-----w C:\Users\Reto\AppData\Roaming\Skype 2008-05-22 20:46 --------- d-----w C:\Users\Reto\AppData\Roaming\Azureus 2008-05-22 20:30 --------- d-----w C:\Program Files\Azureus 2008-05-22 16:07 --------- d-----w C:\Program Files\BitTorrent 2008-05-19 12:45 --------- d-----w C:\Users\Reto\AppData\Roaming\TuneUp Software 2008-05-19 12:45 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-05-19 12:44 --------- d-----w C:\PROGRA~2\TuneUp Software 2008-05-19 12:42 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-05-14 21:20 --------- d-----w C:\Program Files\Windows Mail 2008-05-14 21:20 --------- d-----w C:\PROGRA~2\Microsoft Help 2008-05-13 13:36 --------- d-----w C:\Program Files\Microsoft Games 2008-05-11 21:10 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf 2008-05-11 21:02 --------- d-----w C:\Program Files\Sony Ericsson 2008-05-11 13:39 --------- d-----w C:\Users\Reto\AppData\Roaming\BearShare 2008-05-11 13:37 --------- d-----w C:\Program Files\BearShare Applications 2008-05-06 09:28 --------- d-----w C:\Users\Reto\AppData\Roaming\Ubisoft 2008-05-03 13:47 --------- d-----w C:\Program Files\Java 2008-04-29 14:05 --------- d-----w C:\PROGRA~2\Ubisoft 2008-04-29 13:56 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-29 13:56 --------- d-----w C:\Program Files\Ubisoft 2008-04-29 13:14 --------- d-----w C:\Users\Reto\AppData\Roaming\OpenOffice.org2 2008-04-28 12:05 --------- d-----w C:\Program Files\Didactic 2008-04-28 11:14 --------- d-----w C:\Program Files\Festo Fluidsim 2008-04-24 21:01 --------- d-----w C:\Users\Reto\AppData\Roaming\MyPhoneExplorer 2008-04-24 20:34 --------- d-----w C:\Program Files\VoiceAge 2008-04-21 12:24 --------- d-----w C:\Users\Reto\AppData\Roaming\FL_SIM_P4_DEMO_D 2008-04-20 20:12 --------- d-----w C:\Program Files\Google 2008-04-19 09:45 --------- d-----w C:\Program Files\Safari 2008-04-19 09:43 --------- d-----w C:\Program Files\Apple Software Update 2008-04-18 17:57 --------- d-----w C:\Program Files\FRITZ!BoxPrint 2008-04-18 17:57 --------- d-----w C:\Program Files\FRITZ!Box 2008-04-18 17:22 --------- d-----w C:\Program Files\Canon 2008-04-18 17:21 --------- d--h--w C:\PROGRA~2\CanonBJ 2008-04-18 17:18 --------- d--h--w C:\Program Files\CanonBJ 2008-04-18 17:12 100,736 ----a-w C:\Windows\system32\drivers\avmaura.sys 2008-04-14 19:38 --------- d-----w C:\Program Files\AxBx 2008-04-13 20:08 --------- d-----w C:\Program Files\DNA 2008-04-13 15:44 --------- d-----w C:\PROGRA~2\Avira 2008-04-04 17:06 --------- d-----w C:\Program Files\iTunes 2008-04-04 17:06 --------- d-----w C:\Program Files\iPod 2008-04-04 17:05 --------- d-----w C:\Program Files\QuickTime 2008-04-03 17:55 --------- d-----w C:\Program Files\MyPhoneExplorer 2008-04-02 17:46 --------- d-----w C:\Program Files\bfe-Lernprogramme 2008-04-02 17:41 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-01 10:47 --------- d-----w C:\Program Files\MSBuild 2008-04-01 10:47 --------- d-----w C:\Program Files\Microsoft Works 2008-04-01 10:44 --------- d-----w C:\Program Files\Microsoft.NET 2008-04-01 10:41 --------- d-----w C:\Program Files\Microsoft Visual Studio 8 2008-03-31 19:37 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-03-29 09:13 --------- d-----w C:\Users\Reto\AppData\Roaming\Apple Computer 2008-01-08 12:44 22,328 ----a-w C:\Users\Reto\AppData\Roaming\PnkBstrK.sys 2007-08-29 16:19 174 --sha-w C:\Program Files\desktop.ini 2007-08-26 16:39 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-08-26 16:39 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-08-26 16:39 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2007-08-27 17:04 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2007-08-27 17:04 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2007-08-27 17:04 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2007-09-01 15:44 22 --sha-w C:\Windows\SMINST\HPCD.sys . ------- Sigcheck ------- . (((((((((((((((((((((((((((( Autostart Punkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt. [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-07-14 00:41 20034600] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] "PMCRemote"="C:\Program Files\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe" [2007-02-12 21:12 253000] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 05:36 827392] "QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2007-04-24 03:11 176128] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 20:38 159744] "HP Health Check Scheduler"="C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 20:54 50696] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-05-16 01:38 8429568] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-05-16 01:38 81920] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 22:18 472776] "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-11 01:12 317128] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "CognizanceTS"="c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll" [2003-12-22 20:12 17920] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 22:09 157592] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-06 22:07 185896] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896] "VirusKeeper"="C:\Program Files\AxBx\VirusKeeper 2008 Pro Probeversion\VirusKeeper.exe" [2008-03-21 15:21 2717064] "VaCtrl"="C:\Program Files\VoiceAge\Common\VaCtrl.exe" [2003-08-28 09:08 90112] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [ ] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=APSHook.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.i420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll "msacm.VaAcelpNet"= VaAcelpNet.acm "msacm.VaAmrNbF"= VaAmrNbF.acm "msacm.VaAmrNbV"= VaAmrNbV.acm [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{B200C27A-8669-463A-B132-2A96C0CC6F28}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{4C79F19E-A125-40BF-9076-13058A26413F}"= C:\Program Files\HP\QuickPlay\QP.exe:Quick Play "{824B6293-BEF3-4D86-8C82-2C36319D0D41}"= C:\Program Files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{FD432232-E285-41B0-BACD-05DDE11CB676}"= UDP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{B923F47C-5C75-4D8C-827A-C4EA073F083E}"= TCP:C:\Program Files\Skype\Phone\Skype.exe:Skype "{C9716BFF-14D9-4932-A646-F7289985DA6B}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{FB09CCEE-FABA-4F68-9103-947CF2A65A81}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{A4E14388-A115-4307-9FF7-9E292736FA40}"= UDP:C:\Program Files\Ubisoft\DIE SIEDLER - Aufstieg eines Königreichs\base\bin\Settlers6.exe:DIE SIEDLER - Aufstieg eines Königreichs "{1BDA583C-877C-4B22-90A6-A3BB8C73BE52}"= TCP:C:\Program Files\Ubisoft\DIE SIEDLER - Aufstieg eines Königreichs\base\bin\Settlers6.exe:DIE SIEDLER - Aufstieg eines Königreichs "{51998F12-3DC8-482B-BAA7-0D7577691C71}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{C2D48BFA-50A4-4C96-9D2C-2D77357DDD6A}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{98295E0B-B26B-4C51-BD66-67A5A3E894F3}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{A317A4F1-059F-46D8-B0F7-B4FCDCCB2BFD}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{07614E18-F316-44B6-9154-D3171FBCB679}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{DABC2157-24FD-4357-BCA6-E5695C2F3734}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{B0A114A3-65D1-46B1-866D-7917EBBACBB4}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{673E75BC-41F4-43B9-8445-09AE5A1B8BE5}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{DD75B762-91C6-4AE8-BBDD-29344EC28602}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{B27EF5A9-99CA-4376-9CD0-9304A5FDA55A}"= C:\Program Files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{CD3C7B03-A1E5-4EA8-AED4-72BDDE46B802}"= TCP:1644:Chaoscars "{6CBCBAF6-0162-4E37-9C43-F2BA713F61A4}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{09706325-CB5D-4723-A3E4-93FD54F01ABB}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{6283A014-245D-44DE-9A72-D86E9343E5AB}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{2F87052F-1319-49D0-8C51-771133EC3DD6}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{0E86AC97-87D1-46AC-B085-4BD3BE6984AF}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{95C96F09-810D-40A2-BB23-2291232F5B47}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{9F8A9535-D0D5-41F7-9E41-F49E2FE5BAFD}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{0375AAE2-A808-4F71-8FB0-004AD372A3B2}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove "{CEF2497F-476E-4F68-9BA2-E9A4F6B9DDC1}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{9D046E96-F2FB-4365-A68F-21D1FEC54332}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "TCP Query User{26468D34-A8CB-47D1-B074-E7C6F7F70700}C:\\program files\\zattoo\\zattood.exe"= UDP:C:\program files\zattoo\zattood.exe:zattood "UDP Query User{F1908BD6-E0C5-4364-A6C9-6DAEC16A04F1}C:\\program files\\zattoo\\zattood.exe"= TCP:C:\program files\zattoo\zattood.exe:zattood "{6BCF90A9-33D4-4BCE-8CDC-B68DD59137E3}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{B87FC8DB-12AA-42A3-99CD-E6C186F8C4B2}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{1893431C-C45B-4AC6-AB36-55997E690516}"= UDP:C:\Program Files\DNA\btdna.exe:DNA "{D3AE7BB3-3D69-4F05-BDE0-1132522CC22B}"= TCP:C:\Program Files\DNA\btdna.exe:DNA "{DB48C3D9-833E-4202-9212-9130E2519B01}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent "{B1B9FC4F-D535-4C40-98F0-8505838E0677}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent "TCP Query User{123F86D4-315B-4AB7-9F7A-5EE75CC9D315}C:\\users\\reto\\program files\\dna\\btdna.exe"= UDP:C:\users\reto\program files\dna\btdna.exe:btdna.exe "UDP Query User{2BA7FFEC-8AC9-4B32-8B7C-A00054643114}C:\\users\\reto\\program files\\dna\\btdna.exe"= TCP:C:\users\reto\program files\dna\btdna.exe:btdna.exe "{080F3142-A520-4E51-B766-AFDD3FEB4BCC}"= UDP:C:\Users\Reto\AppData\Local\Apps\2.0\V2V2XYO8.WHX\E5DMHBZK.MNC\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf0e9add42c1\fritzbox-usb-fernanschluss.exe:FRITZ!Box USB-Fernanschluss "{66855321-4FBD-496A-9289-1DC00E38989B}"= TCP:C:\Users\Reto\AppData\Local\Apps\2.0\V2V2XYO8.WHX\E5DMHBZK.MNC\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf0e9add42c1\fritzbox-usb-fernanschluss.exe:FRITZ!Box USB-Fernanschluss "{09A59EE0-48BE-471E-8C44-31D32520A69F}"= Disabled:UDP:E:\fsetup.exe:AVM FSetup Application "{7958495D-A5FB-445D-BC98-F3EF977AF4BD}"= Disabled:TCP:E:\fsetup.exe:AVM FSetup Application "TCP Query User{B6C29CD5-F94C-4478-AEF1-989B79EB4AE3}C:\\users\\reto\\appdata\\local\\temp\\rar$ex00.746\\message-bob.exe"= UDP:C:\users\reto\appdata\local\temp\rar$ex00.746\message-bob.exe:message-bob.exe "UDP Query User{1772B007-55E7-45C3-A2A8-EBB6A8EF8D22}C:\\users\\reto\\appdata\\local\\temp\\rar$ex00.746\\message-bob.exe"= TCP:C:\users\reto\appdata\local\temp\rar$ex00.746\message-bob.exe:message-bob.exe "TCP Query User{FC2E0CAC-7EDD-4976-8D68-C1B369ECFEE7}C:\\users\\reto\\appdata\\local\\temp\\rar$ex00.151\\message-bob.exe"= UDP:C:\users\reto\appdata\local\temp\rar$ex00.151\message-bob.exe:message-bob.exe "UDP Query User{14FDCC0C-50F1-4244-84EA-888B0C4A0053}C:\\users\\reto\\appdata\\local\\temp\\rar$ex00.151\\message-bob.exe"= TCP:C:\users\reto\appdata\local\temp\rar$ex00.151\message-bob.exe:message-bob.exe "TCP Query User{820842EF-0233-46CA-B88F-DFC6C99D7329}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= UDP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{738369FE-430B-465A-8990-0A7091EEA7F1}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= TCP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{25E94F35-74C7-4BEA-A064-822928ABC3EC}C:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= UDP:C:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy "UDP Query User{9420C83B-65F5-4BC2-8851-62D4A569A09C}C:\\sonyericsson\\javame_sdk_cldc\\ondevicedebug\\bin\\serialproxy.exe"= TCP:C:\sonyericsson\javame_sdk_cldc\ondevicedebug\bin\serialproxy.exe:serialproxy "TCP Query User{A3B5EDB0-D764-47EE-A505-BFCC6FDE55AB}C:\\program files\\bittorrent\\bittorrent.exe"= UDP:C:\program files\bittorrent\bittorrent.exe:bittorrent "UDP Query User{B66E2044-3CA3-4BB9-80C7-52A7EEDB00A5}C:\\program files\\bittorrent\\bittorrent.exe"= TCP:C:\program files\bittorrent\bittorrent.exe:bittorrent "{95CFE7AD-70B8-419A-A8BF-D31944B2C279}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{390E8987-0BAE-4AEE-9166-D966D650AA7E}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9 "{627B0925-A5E3-4C5C-AAB7-ECA79224C424}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{28A3F74C-FE3A-4D7C-A526-79014FDDEB6A}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10 "{F3DEEDD3-C582-427F-9B3E-8FA0A754D5C9}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "{4858DA70-1217-4F6C-AB8A-42AE13EABB24}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update "TCP Query User{499730E9-A6FD-4EF1-AF89-DB0685EFC120}C:\\program files\\sony ericsson\\update service\\update service.exe"= UDP:C:\program files\sony ericsson\update service\update service.exe:Update Service "UDP Query User{0DB6A7BC-BE29-4B58-86FB-457BBA324AA8}C:\\program files\\sony ericsson\\update service\\update service.exe"= TCP:C:\program files\sony ericsson\update service\update service.exe:Update Service "TCP Query User{4F269834-A579-4678-BF58-CC41CA68F7AF}C:\\program files\\azureus\\azureus.exe"= UDP:C:\program files\azureus\azureus.exe:Azureus "UDP Query User{2B831331-C295-4773-97BD-7C876CFD6557}C:\\program files\\azureus\\azureus.exe"= TCP:C:\program files\azureus\azureus.exe:Azureus [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent R2 ASBroker;Logon Session Broker;C:\Windows\System32\svchost.exe [2006-11-02 11:45] R2 ASChannel;Local Communication Channel;C:\Windows\System32\svchost.exe [2006-11-02 11:45] R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\Windows\system32\drivers\LMIRfsDriver.sys [2007-08-03 16:09] R2 UxTuneUp;TuneUp Designerweiterung;C:\Windows\System32\svchost.exe [2006-11-02 11:45] R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-11-28 18:44] R3 avmaura;AVM USB-Fernanschluss;C:\Windows\system32\DRIVERS\avmaura.sys [2008-04-18 19:12] R3 nvsmu;nvsmu;C:\Windows\system32\DRIVERS\nvsmu.sys [2007-02-17 01:50] S3 BCM43XV;Broadcom Extensible 802.11-Netzwerkadaptertreiber;C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-01-03 17:43] S3 ggflt;SEMC USB Flash Driver Filter;C:\Windows\system32\DRIVERS\ggflt.sys [2007-09-25 17:37] S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;C:\Windows\system32\Drivers\hcw95bda.sys [2007-10-25 10:47] S3 hcw95rc;Hauppauge MOD7700 IR Driver;C:\Windows\system32\DRIVERS\hcw95rc.sys [2007-10-25 10:52] S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst;C:\Windows\System32\TuneUpDefragService.exe [2008-05-19 14:45] S3 USB28xxBGA;PCTV 330e/800e Device;C:\Windows\system32\DRIVERS\emBDA.sys [2007-01-29 21:20] S3 USB28xxOEM;USB 28xx OEM Filter;C:\Windows\system32\DRIVERS\emOEM.sys [2007-01-29 21:19] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel GPSvcGroup REG_MULTI_SZ GPSvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5c99a4df-59fb-11dc-8192-001b2473a716}] \shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abd6dd04-6076-11dc-9117-001a737e3b77}] \shell\AutoRun\command - H:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cf7ba0b4-53b3-11dc-bbfc-001a737e3b77}] \shell\AutoRun\command - setupSNK.exe . Inhalt des "geplante Tasks" Ordners "2008-05-24 16:43:31 C:\Windows\Tasks\1-Klick-Wartung.job" - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe "2008-02-28 19:23:01 C:\Windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job" |
Hi :) Das sieht gut aus :) Deinstalliere Combofix wieder, indem du unter Start->Ausführen-> combofix /u eingibst. Hast du noch Popups? lg myrtille |
Danke, bis jetzt ist keine werbung mehr gekommen, aber wenn ich bei "Ausführen" combofix/u eingebe, wird nichts gefunden. kann ich die anwendung nicht einfach löschen? |
Mache mal bitte sicherheitshalber das wegen navipromo: Bitte lade Dir Navilog1 von IL-MAFIOSO herunter.
Hinweis: Navilog1.exe und andere Dateien, werden aehnlich wie process.exe, von einigen Antiviren Herstellern / Firewall Herstellern als sogenannte Risktools erkannt. Es ist kein Virus, sondern ein Programm zur Reinigung dieser Infizierung.[noparse] bitte dann neu starten und das ganze mit option 2 durchführen. poste beide logs. danach neu starten und das hier: * Lade Malwarebytes' Anti-Malware auf deinen Desktop herunter. www.malwarebytes.org/mbam.php - 10k - * Mache einen Doppel-Klick auf die mbam-setup.exe und folge den Hinweisen, um das Programm zu installieren. * Vergewissere dich nun, dass folgende Optionen angehakt sind: o Malwarebytes' Anti-Malware updaten o Malwarebytes' Anti-Malware starten * Klicke nun auf Fertigstellen. * Wenn ein Update gefunden wird, wird es heruntergeladen und die neueste Version installieren. * Wenn das Programm fertig geladen ist, wähle kompletScan durchführen, klicke auf Scan. * Wenn der Scan beendet ist, klicke auf OK, dann auf Ergebnisse anzeigen. * Vergewissere dich, dass neben allen Malware-Einträgen ein Häkchen sitzt. * Klicke dann auf 'Ausgewähltes entfernen' und auf OK. danach hijackthis-log posten und berichte wie es läuft. bin erst ab morgen um 5 wieder da...[/QUOTE] |
Zitat:
@Navilog Lass es (von mir aus) durchlaufen, du kannst es später über Start->Systemsteuerung->Software wieder deinstallieren (genauso wie Malwarebytes Ant-Malware, falls du das nicht behalten willst) lg myrtille |
@ markusg also ich habe mir das Navilog1 runtergeladen und installiert. wenn ich das jetzt starte gebe ich e für englisch ein und dann enter, dann kommt nichts mehr und das fenster verschwindet? @ myrtille stimmt, habe das leerzeichen vergessen, aber jetzt werde ich gefragt, ob ich combofix ausführen will aber ich will das doch deinstallieren und die werbung kommt leider immer noch einfach nicht mehr so heufig |
was soll ich jetzt tun? |
Hi, sry. Du kannst Combofix auch einfach manuell löschen. Würdest du Navilog über Start->Systemsteuerung->Software bitte einmal deinstallieren. Erneut herunterladen und die Installation per Rechtsklick als Administrator starten? Wenn die Installation glückt bitte Navilog auch wieder per Rechtsklick als Admin starten. lg myrtille |
danke , ich werde es morgen nochmal versuchen |
danke es hat geklappt hier ist der bericht von Navilog1: Search Navipromo version 3.5.7 began on 2008-05-29 at 19:00:42.48 !!! Warning, this report may include legitimate files/programs !!! !!! Post this report on the forum you are being helped !!! !!! Don't continue with removal unless instructed by an authorized helper !!! Fix running from C:\Program Files\navilog1 Actual User Account : "***" Updated on 11.05.2008 at 18h00 by IL-MAFIOSO Microsoft Windows Vista 6.0.6000 Version Internet Explorer : 7.0.6000.16643 Filesystem type : NTFS Search done in normal mode *** Search folders in "C:\Windows" *** *** Search folders in "C:\Program Files" *** *** Search folders in "C:\ProgramData" *** *** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" *** *** Search folders in "c:\users\***\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Search folders in "C:\Users\***\AppData\Local\virtualstore\Program Files" *** *** Search folders in "C:\Users\***\AppData\Roaming" *** *** Search with Catchme-rootkit/stealth malware detector by gmer *** for more info : [url]http://www.gmer.net[/*url] No file found *** Search with GenericNaviSearch *** !!! Possibility of legitimate files in the result !!! !!! Must always be checked before manually deleting !!! * Scan in "C:\Windows\system32" * * Scan in "C:\Users\***\AppData\Local\Microsoft" * * Scan in "C:\Users\***\AppData\Local\virtualstore\windows\system32" * * Scan in "C:\Users\***\AppData\Local" * *** Search files *** *** Search specific Registry keys *** *** Complementary Search *** (Search specific files) 1)Search new Instant Access files : 2)Heuristic Search : * In "C:\Windows\system32" : * In "C:\Users\***\AppData\Local\Microsoft" : * In "C:\Users\***\AppData\Local\virtualstore\windows\system32" : * In "C:\Users\***\AppData\Local" : 3)Certificates Search : Egroup certificate not found ! Electronic-Group certificate found ! OOO-Favorit certificate found ! Sunny-Day-Design-Ltd certificate not found ! 4)Search known files : *** Search completed on 2008-05-29 at 19:11:52.06 *** |
Hi, du kannst die Zertifikate noch löschen. Gehe über Start->Systemsteuerung->Internetoptionen->Inhalt->Zertifikate und deinstalliere wenn vorhanden das Zertifikat von: Zitat:
lg myrtille |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 04:28 Uhr. |
Copyright ©2000-2025, Trojaner-Board