Hallo
Ich habe seit einer LAN mit Kumpels
Probleme mit meinem Rechner.
Ich habe vermehrt und permanent Adware als TrackingCookies...
weiterhin hat NUR SpywareDoctor NetDevil und Look2Me gefunden...
mein Vater hat dann selbst Hand in den Registrydaten angelegt und alles manuell gelöscht...
er meint es sei noch nicht damit getan...
Ich will NetDevil und den ganzen Rest endlich los werden!
Ich will jetz mal Sophos Anti-Virus testen... da dieser wohl NetDevil erkennt...
Weiterhin muckt meine Maus rum...
wenn ich einen Text wie diesen schreibe macht sie sich selbstständig und ich lande irgendwo mitten im Text und komme ganz durcheinander da dies mitten im Schreben hab ich noch einen Vorgang namens Notifier beendet..
ich hatte keine ahnung wa das war...

ich hab über google gelesen das NetDevil etwas mit Hackern zu tun hat...stimmmt das?
kann es sein das ein Hacker mich angreift???

seit eben hab ich mir gedanken über sober gemacht...
da schon öfter winlogon.exe versucht hat auf das internet zuzugreifen...



also ich suche eine möglichkeit das kram zu entfernen...
die neu-installation vom OS sollte der letzte weg seineiben passiert...

Poste bitte ein HijackThis Logfile damit man sich eine übersicht über deine
Viren machen kann.
Anleitung:
http://www.trojaner-board.de/showthread.php?t=17493

Und für eScan AntiVirus aus.
Anleitung:
http://www.trojaner-board.de/showthread.php?t=24192

Hier:

Logfile of HijackThis v1.99.1
Scan saved at 19:24:05, on 08.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programme\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
c:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Programme\Spyware Doctor\sdhelp.exe
c:\Programme\Sophos\AutoUpdate\ALsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Spyware Doctor\swdoctor.exe
C:\WINDOWS\explorer.exe
C:\Programme\Microsoft IntelliPoint\Point32.exe
C:\Programme\Xfire\Xfire.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\imapi.exe
C:\Programme\Ahead\Nero\nero.exe
C:\Dokumente und Einstellungen\Mark.MOBI.000\Desktop\Downloads\Prog!\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Spyware Protection Pro] C:\Programme\3B Software\Spyware Protection Pro\SpywareProtectionPro.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programme\Spyware Doctor\swdoctor.exe" /Q
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {36D5E913-C8E0-4155-99E2-92155E802C46} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {36D5E913-C8E0-4155-99E2-92155E802C46} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra button: eBay - {C61A2E0E-6D7E-4555-ACA0-50DB2CD83D4B} - C:\Programme\Internet Explorer\Signup\ToshibaGotoEbay.exe (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC6EA47B-B558-4642-9A52-33CFEF8B65EE}: NameServer = 192.168.0.1,192.168.0.8
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\g204lcdq1f0e.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Programme\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos plc - c:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos plc - c:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programme\Spyware Doctor\sdhelp.exe
O23 - Service: Sophos AutoUpdate Service - Sophos plc - c:\Programme\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe











mit eScan habe ich das Problem, dass ich ausversehen auf deutsch gedrückte habe... nun funktioniert die find.bat nicht?
Wie kann ich das wieder umstellen?

Hallo,
na da war der Vater aber nicht erfolgreich, hätte mich bei look2me auch sehr gewundert.
Mach mal folgendes, und danach auch noch mit Ewido drübergehen. Beide Programme können danach wieder deinstalliert werden da sie nur 14tägige Trialversionen sind.
Was Escan angeht kannst du einfach die MWAV.LOG öffnen und dort nach den Worten "infected" "tagged" und "offending" suchen und die jeweiligen Einträge posten.


Grüße Wildone

MWAV sagt mir folgendes bei Virus gefunden:
Teil1 (weil liste zu lang)

File C:\WINDOWS\system32\dbvvox.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cJmocx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lecalspl.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wqpshell.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mrhgrcoi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cfetcfg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mhrmsg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dqnhupnp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cmetcfg.dll tagged as
"not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sgnscfg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MYC42DEU.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\modsrv32.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ivakui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\davoice.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\pqintui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MGPagAx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kidsl1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\neshrui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\gukrsrc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\uorv42a.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\rkched20.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wtdmtpus.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dm4601hse.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\acmpvcno.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\muiole16.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\EtnClass.Dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sjdoclc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dS0mlgd1160.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\idrdbg32.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MPAviAx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\WFVADVE.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\CjEPPolicy.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kqdsl1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cA00lidm180a.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

Object "searchexe Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "thelocalsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "advsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Object "zipitpro Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object
"C:\Mark\Musik\Programme\MidiNotate\Songs\Mozart40thSymphony.mid". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Mark\Musik\Programme\MidiNotate\Songs\RhapsodyInBlue.not". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Mark\Musik\Programme\MidiNotate\Songs\Minuet.mid". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Mark\Musik\Programme\MidiNotate\NoteSoft.ini". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\IOSUBSYS\C2REC.VXD". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\C2ASPI.DLL". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\CDDBControl.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\IOSUBSYS\asapi.vxd". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\asapi.dll". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\gimp-2.0.exe" refers to invalid object "C:\Programme\GIMP-2.0\bin\gimp-2.0.exe". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\3rd Party Plugins\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\3rd Party Plugins\N-Rage\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\Cheat Codes\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\Game FAQ\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\Plugin Specs\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\RDB\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Docs\RDX\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Lang\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Emus and Roms\N64\Project64\Plugin\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\autoback\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\downloads\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\express\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\fonts\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\gamepacks\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\html\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\images\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\Maps\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\meshes\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\Scenes\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\sounds\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\scripts\startup\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\scripts\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\web\graphics\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\web\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\ui\2dicons\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\ui\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\ui\macroscripts\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\ui\Icons\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\stdplugs\stdscripts\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\stdplugs\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\plugins\HardwareShaders\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\plugins\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\matlibs\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Mark\Games\Model Maker\GMax\drivers\". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "c:\Mark\Neuer Ordner\". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ADM". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts"
refers to invalid object ".gcf". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".jsf". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mdl". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".v64". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".wad". Action Taken: No Action Taken.

Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".z64". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "a-squared Free_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "AVM ISDN CAPI Port". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "bleem!". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Cannon Smash". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Corel WordPerfect Suite 8". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Counterstrike Configmaker_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Dune 2000". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "GDGAniTuner11". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "HexDump plug-in for Ad-Aware SE". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "HLSW_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Lavasoft VX2 Cleaner". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "LSP Explorer plug-in for Ad-Aware SE". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "LucasArts' Curse of Monkey Island". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "mIRC". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "PicGrab_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SiSoftware Sandra Lite 2005.SR1_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "The Adventures of Zak McKracken". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "TOSHIBA Software Modem". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Tweak-SE plug-in for Ad-Aware SE". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App
Management\ARPCache" refers to invalid object "UT2004". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Windows Registry Repair Pro_is1". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "WOLAPI". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{0BEDBD4E-2D34-47B5-9973-57E62B29307C}". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{319D9385-EEC1-4ae5-BFD1-C5DE1E063F30}". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{3877C2CD-F137-4144-BDB2-0A811492F920}". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{5A96225D-A3B7-4535-AE49-3BF217999669}". Action Taken: No Action Taken.

Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{64635543-70E7-436D-8D6D-4A721595029E}". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{180F5CF2-7F83-411E-B54F-BBA69A4E1A70}" refers to invalid object "C:\WINDOWS\system32\nzxpnt.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{3E642DCE-C891-49AF-8184-728FE2F5E519}" refers to invalid object "C:\WINDOWS\system32\jR4o0ah3ed4.dll". Action Taken: No Action Taken.

Entry "HKCR\TypeLib\{9C8CCF00-F10F-11CE-9A35-00AA005370B0}" refers to invalid object "c:\Mark\Musik\Programme\Anvil Studio\MidiCtl.ocx". Action Taken: No Action Taken.

Entry "HKCR\.alpha" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.als" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.asa" refers to invalid object "aspfile". Action Taken: No Action Taken.

Entry "HKCR\.bitmap" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.cdx" refers to invalid object "aspfile". Action Taken: No Action Taken.

Entry "HKCR\.CEL" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.DCM" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.DICOM" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.icon" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.im1" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.im24" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.im32" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.im8" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.jpeg" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.mask" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.matte" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.max" refers to invalid object "Paper.Document". Action Taken: No Action Taken.

Entry "HKCR\.pbm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.pgm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.PIX" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.png" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.pnm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.ppm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.ps" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.psd" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.ras" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.rs" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.svg" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.tga" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.vss" refers to invalid object "Visio.Stencil.11". Action Taken: No Action Taken.

Entry "HKCR\.vst" refers to invalid object "Visio.Template.11". Action Taken: No Action Taken.

Entry "HKCR\.wmf" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.xbm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.xpm" refers to invalid object "TheGIMP20". Action Taken: No Action Taken.

Entry "HKCR\.xwd" refers to invalid object "TheGIMP20". Action Taken: No
Action Taken.

Entry "HKCR\3DStudio.GMAX\shell\open\command" refers to invalid object "C:\Mark\Games\Model Maker\GMax\gmax.exe %1". Action Taken: No Action
Taken.

Entry "HKCR\FinaleAutoSave\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\FinaleBinary\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\FinaleETF\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\FinaleFPA\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

teil 2 (rest der liste)

Entry "HKCR\FinaleLSN\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\FinaleTemplate\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\FinaleWorksheet\shell\open\command" refers to invalid object ""\\MOBI\Mark\Musik\Programme\NotePad '05\FinaleNotePad.exe" "%1"". Action Taken: No Action Taken.

Entry "HKCR\Hammer.Map\shell\open\command" refers to invalid object "C:\Mark\Games\ZUBEHR~1\COUNTE~1\Mapping\HAMMER~1.EXE "%1"". Action Taken: No Action Taken.

Entry "HKCR\hlsw\shell\open\command" refers to invalid object "C:\Mark\Games\HLSW\hlsw.exe "-PATH:C:\Mark\Games\HLSW\" "-URL:%1"". Action Taken: No Action Taken.

Entry "HKCR\HLSW Server List\shell\open\command" refers to invalid object "C:\Mark\Games\HLSW\hlsw.exe "-PATH:C:\Mark\Games\HLSW\" "-SL:%1"". Action Taken: No Action Taken.

Entry "HKCR\notefile\shell\open\command" refers to invalid object "C:\Mark\Musik\Programme\MidiNotate\MNPlayer\MNPlayer.exe %1". Action Taken: No Action Taken.

Entry "HKCR\satstrat\shell\open\command" refers to invalid object "C:\Mark\Games\Zubehör\Counter Strike\Tactic\S2SaTstrat\stratplanner.exe". Action Taken: No Action Taken.

File C:\Archiv\Verschiedenes\getrgt.exe tagged as "not-a-virus:AdWare.Win32.TimeSinc". Action Taken: No Action Taken.

File C:\Dokumente und Einstellungen\Administrator.MOBI\Lokale Einstellungen\Anwendungsdaten\RegFreeze\protection\fea620a776b442c3b0d02e0dda457868 infected by "Trojan.Win32.Qhost.ew" Virus! Action Taken: No Action Taken.

File C:\Mark\Games\Zubehör\Counter Strike\girc432.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.

File C:\WINDOWS\system32\abfsipc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ajctres.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\amsldp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\anptif.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\asivvaxx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\aza20gfoe62c0.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\azam07j1e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\azioglxx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.


File C:\WINDOWS\system32\c600lgdm160a.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\c800lidm180a.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\CbTPPolicy.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ccb.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cFmocx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cgyptdll.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cjetcfg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cniconfg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\CqTPPolicy.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\CsTPPolicy.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\curtcli.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cvmsnap.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\cwsetACL.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\d60mlgd1160.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\damv2clt.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dg4601hse.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dn0401dqe.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dn2201foe.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dn2801fue.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dn4601hse.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dnl6013se.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dnpu0179e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dnro0193e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dprgui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dqcpmon.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\drivers\etc\hosts infected by "Trojan.Win32.Qhost.ew" Virus! Action Taken: No Action Taken.

File C:\WINDOWS\system32\dsrgres.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\dXdramp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\eipthp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\en28l1fu1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\enj0l11m1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\fp8003lme.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\fp8s03l7e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\fpl0033me.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\fppo0373e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\g6220gfoe62c0.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\gp62l3jo1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\gppol3731.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\h4n00e5meh.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hoink.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hr0805due.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hr2q05f5e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hr6m05j1e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hr8005lme.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\hr8m05l1e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\i4jq0e15eh.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\i8420ihoe84c0.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ibclass.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\idetpp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ifetpp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ih41_qcx.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\IMIresizeP6.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\IMKED.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\iqsetup.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ir40l5hm1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ir68l5ju1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ir82l5lo1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\irpml5711.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\irrml5911.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\IXIresizeW7.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\iyetpp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\j04o0ah3ed4.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\j82q0if5e82.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jhdw400.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jr2025fmg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jt0007dme.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jt6m07j1e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jtn6075se.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jtp0077me.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jtp2077oe.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\jtr6079se.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\k0js0a17ed.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\k2260cfsef260.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\k608lgdu1608.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\k6440ghqe64e0.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kcdpl.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\khdhu1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kkdfi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kkdhept.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kpdsw.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ktjsl7171.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\kvdru.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\l28mlcl11fq.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\l4n4le5q1h.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lbcmgr10.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lgcalui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lor0099me.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lqrt.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lv0q09d5e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lv2o09f3e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvj6091se.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvjm0911e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvnm0951e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvns0957e.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvr0099me.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\lvr6099se.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\m2rm0c91ef.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\m4nq0e55eh.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\m6nqlg5516.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\m8820iloe8qc0.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mbhcp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mcjter35.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\md46l9hs1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mdd32.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\meapsspc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mmd32.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MQCUIA32.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mrcpx32r.dLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MV32.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mv46l9hs1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mv68l9ju1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\MVC42ENU.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mvi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mvnul9591.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\mvr0l99m1.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\myident.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\n22u0cf9ef2.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\n6l80g3ue6.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\n86qlij518o.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ndmkcert.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nmdeapi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nohtml.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\npprovau.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nuhtml.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\nvl0293mg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o0660ajsedo60.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o0pqla751d.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o2pqlc751f.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o4pq0e75eh.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o6ro0g93e6.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\o884lilq18qe.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\oaesvr.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\osg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\p4r40e9qeh.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\p4r4le9q1h.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\p88q0il5e8q.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\pfintui.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\poapi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\ppustab.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\r2r6lc9s1f.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\rlr20.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\rLsppp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\rmr20.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\Rphtxde.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\s8puli7918.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sbxcoins.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sccpack.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sci_ci.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\snc_os.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\snrmdll.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sondmail.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\sSmlib.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\stndcmsg.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\t8r8li9u18.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\TcriXXX010205PNG.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\u0rula991d.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\u8ruli9918.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\unrfaxa.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\upiplat.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\vcpodbc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\vmsapi.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\VN6DE.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\vumredir.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wasdmoe.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wcp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wdavusd.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\WGDMPS.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wgp.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wossvc.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\WPDMPS.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

File C:\WINDOWS\system32\wrn32spl.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

Hallo,
schick, da haben ja Spysweeper und Ewido einiges zu tun, poste nachdem sie beide gelaufen sind ein neues HijackThis Log.


Grüße Wildone

danke... mach ich...
danke für eure hilfe...

Hallo,
scheint tatsächlich so das Spysweeper nur noch scannt und nicht mehr entfernt, poste mal trotzdem noch mal ein neues HijackThis log.
Außerdem besorgst du dir mal dieses Tool und führst es mal nur mit der ersten Option aus und postest dann das Log das dann erscheint.


Grüße Wildone

hmm...es ist so das spwywaredoctor auch noch backdoor.netdevil findet...
nur er kann es demo nicht entfernen...

Logfile of HijackThis v1.99.1
Scan saved at 16:05:04, on 09.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Programme\ewido\security suite\ewidoctrl.exe
C:\Programme\ewido\security suite\ewidoguard.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
c:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Programme\Spyware Doctor\sdhelp.exe
c:\Programme\Sophos\AutoUpdate\ALsvc.exe
C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Programme\TOSHIBA\Power Management\CePMTray.exe
C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\Programme\ewido\security suite\securitysuite.exe
C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Mark.MOBI.000\Desktop\Downloads\Prog!\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [CeEPOWER] C:\Programme\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CeEKEY] C:\Programme\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Spyware Protection Pro] C:\Programme\3B Software\Spyware Protection Pro\SpywareProtectionPro.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programme\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: eBay - {C61A2E0E-6D7E-4555-ACA0-50DB2CD83D4B} - C:\Programme\Internet

Explorer\Signup\ToshibaGotoEbay.exe (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC6EA47B-B558-4642-9A52-33CFEF8B65EE}: NameServer = 192.168.0.1,192.168.0.8
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\l82s0if7e82.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Programme\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programme\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - T-Online International AG, Marmiko IT-Solutions

GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos plc - c:\Programme\Sophos\Sophos

Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Sophos plc - c:\Programme\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programme\Spyware Doctor\sdhelp.exe
O23 - Service: Sophos AutoUpdate Service - Sophos plc - c:\Programme\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programme\Webroot\Spy

Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





mit dem tool...
komm ich nicht klar... ich weiss nich wie ich es starte...
irgendwie hat der als ich irgendwo draufgeklickt habe den rechner neu gestartet...


ich hab noch ein großes problem...
meine maus macht was sie will.. wenn ich einen text wie diesen hier schreibe...
sie setzt mich von alleine irgendwo mitten in den text

ich hab noch ein großes problem...
meine maus macht was sie will.. wenn ich einen text wie diesen hier schreibe...
sie setzt mich von alleine irgendwo mitten in den text[/QUOTE]

Hört sich böse nach einen Backdoor an leider kenne ich mich mit den Prozessen nicht so aus warte mal bis jemand der sich auskennt was postet.

Hallo,
wo(genauer Pfad) zeigt Spywaredoctor den angeblichen Backdoor an, kann mir eigentlich nicht vorstellen das da einer ist, da Escan den sonst sehr wahrscheinlich gefunden hätte.
Kommt die Werbung eigentlich noch, denn Spysweeper hat ja immerhin etwas gemacht, fixe mal noch folgenden Eintrag:
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\l82s0if7e82.dll (file missing)
Findet Ewido noch etwas? Look2me?
Was dein Mausproblem angeht habe ich dafür keine Erklärung, falls es eine Funkmaus ist, kannst du es mal mit einem Batteriewechsel versuchen.


Grüße Wildone

die mausprobleme hatte ich schon mit einer früheren maus auf dem selben rechner...

SpywareDoctor sagt mir...
dass sich Backdoor.NetDevil unter registry eintraägen...
weis nicht mehr genau wo...
aber der meitne .dll und.dll##
.dll## gibt es nicht!

eScan hat nur look2me gefunden... und noch etwas anderes...
hab ich ja gepostet...
ewido hat mehr als 200 meldungen wegen look2me und hat sie wohl auch entfernt...

SpySweeper zeigt... läuft grad nochmal durch
bisher folgendes:

Trojan Horse found: schaden
Trojan Horse found: acid reign
Adware found: dollarrevenue
Adware found: command
Trojan Horse found: dp trojan
Adware found: regfreeze desktop hijack
Spy Cookie found: 2o7.net cookie
Spy Cookie found: atwola cookie

Hallo,
auch bei den Spysweeper die Funde immer mit Pfaden posten, sonst kann ich damit nicht arbeiten.
Hast du den Eintrag mit HijackThis gefixt?
Kommen noch die Werbefenster?
Bei Spywaredoctor wäre schon gut zu erfahren wie die genaue Meldung (plus Pfad) war, schau noch mal ob du einen Report findest.


Grüße Wildone

entschuldigung...
spysweeper hat bis eben alles gemacht und konnte desshalb mich nicht mit hijack und SD beschäftigen..
einen Moment bitte