kein Internet Explorer und Norton Antivirus

austria3 · 20.02.2007, 19:43

Hallo liebe Forumgemeinde!

jetzt ist es auch bei mir so weit ich benötige dringend eure Hilfe. Ich hoffe ich habe alle Regeln beachtet.

Mein Problem: letzten Freitag war mein Laptop seit ca. 3 Wochen zum ersten mal wieder in Internetz. Norton Antivirus hat gleich mal Live Update ausgeführt und bei einem anschließenden Quikscan 2 Infizierte Dateien gefunden (leider weis ich die Namen nicht mehr) und ausgeschlossen. Beim anschließdenen komplett Scan war nichts mehr zu finden und auch ein am Abend nochmals duchgeführte Komplett Scan hat nichts gefunden.

Am Samstag wollte ich dann ins Internet und plötzlich konnte IE 6 keine Seite mehr aufbauen, auch Firefox funktionierte nicht, Netscape hingegen ohne Probleme. Norton Anrivirus konnte ich auch nicht mehr straten war aber laut Taskmanager aktiv. Der Laptop ließ sich anschließend auch nicht mehr ordentlich runterfahren "ccApp.exe" konnte nicht beendet werde.

Seit gestern versuche ich nun erfolglos dem Problem Herr zu werden. Im abgesicherten Modus hat ein Scan von Norton Antivirus folgendes gefunden:

backdoor.trojan
adware.zangosearch

nach einem neuerlichen Neustart hat sich aber an meinem Problem nix geändert (Systemwiederherstellung deaktiviert)

Hier also mein log file zur allgemeinen Beguachtung:

Logfile of HijackThis v1.99.1
Scan saved at 19:16:17, on 20.02.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\Programme\Intel\Wireless\Bin\WLKeeper.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programme\Apoint\Apoint.exe
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\CNOServerLauncher.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\BarrMon.exe
C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\Digital Line Detect\DLG.exe
C:\PROGRA~1\MAGICM~1\MAGIC-~1.94B\Magic.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Programme\Apoint\Apntex.exe
C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MS_update_0612_KB74062.exe
C:\DOKUME~1\*\LOKALE~1\Temp\symlcsv1.exe
C:\DOKUME~1\*\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = htp://***.euro.dell.com/countries/at/dea/gen/default.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = htp://google.icq.com/search/search_frame.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = htp://**.euro.dell.com/countries/at/dea/gen/default.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {161B98EA-C767-4204-AC01-7ECC6E85D6F6} - C:\WINDOWS\system32\jidajid.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DMXLauncher] C:\Programme\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programme\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Barricade-Monitor] C:\WINDOWS\BarrMon.exe "NoSound"
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Programme\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MS_update_0612_KB74062.exe
O4 - Global Startup: Verknüpfung mit stefan.magic.lnk = ?
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {46C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDPass Class) - http://www.cdpass.com/cdkey/CDPass.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O17 - HKLM\System\CS3\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O20 - Winlogon Notify: hfrkhnpk - C:\WINDOWS\SYSTEM32\jidajid.dll
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe

Was hab ich mir da eingefangen

Und hätte das Antivirus nicht finden sollen?

Danke

Stefan

cosinus · 20.02.2007, 21:17

Zitat:

C:\WINDOWS\BarrMon.exe
CNOServerLauncher.exe

Sind dir diese Programme bekannt?
Ansonsten seh ich da zwei eklige Dateien, von denen ich mit ziemlicher Sicherheit von Malware ausgehe:

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MS_update_0612 _KB74062.exe
C:\WINDOWS\system32\jidajid.dll

Die sollten wir mal genauer untersuchen. Damit du die online auswerten kannst, solltest du diese zuerst mal mit Killbox löschen. Denn es ist nicht unwahrscheinlich, dass diese Dateien vom Schädling "geschützt" sind und somit der Zugriff darauf verhindert wird.
Besorg dir Killbox und starte es. Kopier dazu die Pfadanangaben zuerst von einer Datei in das Adressfeld von Killbox. Dann aktivierst du die Option "Delete on reboot" und klickst auf das rote Schild mit dem weißen X. Die folgende Frage mit Nein beantworten, sonst würde das System neustarten, aber wir wollen ja, das beide Dateien beim nächsten Systemstart gelöscht werden.
Das gleiche machst du dann mit der anderen Datei auch und startest dann Windows neu.
Schau mal danach in den neuen Ordner C:\!KILLBOX\, ob sich dort die Dateien drin befinden, denn Killbox verschiebt die Dateien nur. Achte darauf, dass alle Dateien angezeigt werden. Werte dann diese beiden Dateien anschließend bei Virustotal aus und poste sämtliche Ergebnisse, auch Infos zu Dateigrößen und Prüfsummen.
Mach auch mal bitte einen Check mit Blacklight und poste das Ergebnis.

irrlicht · 20.02.2007, 21:31

Hallo,

Zitat:

C:\WINDOWS\BarrMon.exe

Routersoftware,mein Bremer Freund...

Passt aber nicht zu seinem derzeitigen Router

Zitat:

O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe

Könnte das mit deiner Arbeit oder Uni oder Ähnlichem zusammenhängen ?
Irrlicht

austria3 · 21.02.2007, 18:42

Guten Abend die Herren

BarrMon.exe
stimmt ist ein Programm dass mir den Status meines Roters anzeigt (derzeit nicht angeschlossen)

CNOServerLauncher.exe
da musste ich Google bemühen und bin zu folgendem Ergenis gekommen:
Agiert als Schnittstelle zwischen den Katalogsystemen und den Kundenspezifischen Clients und dem Defaultbrowser. Er leitet z.B. Bestellanforderungen an den Client weiter und steuert andererseits im Katalog eine vom Client angeforderte Seite an.
Das ganze hat sich beim instalieren eines Werkzeugkataloges von einer CD (Fa. Schachermayer vermute ich mal) raufkopiert !

ihr wartet sicher schon gespannt auf die Ergebnisse! dann will ich euch nicht länger auf die Folter spannen:

MS_update_0612_KB74062.exe

Antivirus Version Update Result
AntiVir 7.3.1.37 02.21.2007 TR/Dldr.Murlo.EX.13
Authentium 4.93.8 02.21.2007 W32/Downloader.AXRK
Avast 4.7.936.0 02.21.2007 no virus found
AVG 386 02.21.2007 Downloader.Small.57.A
BitDefender 7.2 02.21.2007 no virus found
CAT-QuickHeal 9.00 02.21.2007 no virus found
ClamAV devel-20060426 02.21.2007 no virus found
DrWeb 4.33 02.21.2007 no virus found
eSafe 7.0.14.0 02.21.2007 Win32.Murlo.ex
eTrust-Vet 30.4.3417 02.21.2007 Win32/Cavitate!generic
Ewido 4.0 02.21.2007 Downloader.Murlo.ex
FileAdvisor 1 02.21.2007 no virus found
Fortinet 2.85.0.0 02.21.2007 W32/BackDoor.EX!tr.dldr
F-Prot 4.2.1.29 02.21.2007 W32/Downloader.AXRK
F-Secure 6.70.13030.0 02.21.2007 Trojan-Downloader.Win32.Murlo.ex
Ikarus T3.1.0.31 02.21.2007 Trojan-Downloader.Win32.Murlo.ex
Kaspersky 4.0.2.24 02.21.2007 Trojan-Downloader.Win32.Murlo.ex
McAfee 4968 02.21.2007 Generic BackDoor.n
Microsoft 1.2204 02.21.2007 no virus found
NOD32v2 2073 02.21.2007 a variant of Win32/TrojanDownloader.Murlo
Norman 5.80.02 02.21.2007 W32/DLoader.BWBJ
Panda 9.0.0.4 02.21.2007 Trj/Downloader.MCI
Prevx1 V2 02.21.2007 Trojan.UpdateKB
Sophos 4.14.0 02.21.2007 no virus found
Sunbelt 2.2.907.0 02.17.2007 VIPRE.Suspicious
Symantec 10 02.21.2007 no virus found
TheHacker 6.1.6.062 02.21.2007 Trojan/Downloader.Murlo.ex
UNA 1.83 02.20.2007 TrojanDownloader.Win32.Murlo.51D8
VBA32 3.11.2 02.20.2007 Trojan-Downloader.Win32.Murlo.ex
VirusBuster 4.3.19:9 02.21.2007 no virus found

Aditional Information
File size: 22016 bytes
MD5: ba10f76dfddeaa4bf6d7fed7498dd19c
SHA1: 9e863c929e5913528427ad71a1b7a165c7142178
packers: ASPACK
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=280e67296667
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

--------------------------------------------------

jidajid.dll

Antivirus Version Update Result
AntiVir 7.3.1.37 02.21.2007 TR/Dldr.ConHook.Gen
Authentium 4.93.8 02.21.2007 no virus found
Avast 4.7.936.0 02.21.2007 no virus found
AVG 386 02.21.2007 no virus found
BitDefender 7.2 02.21.2007 no virus found
CAT-QuickHeal 9.00 02.21.2007 no virus found
ClamAV devel-20060426 02.21.2007 no virus found
DrWeb 4.33 02.21.2007 Trojan.Click.1998
eSafe 7.0.14.0 02.21.2007 Suspicious Trojan/Worm
eTrust-Vet 30.4.3417 02.21.2007 no virus found
Ewido 4.0 02.21.2007 no virus found
FileAdvisor 1 02.21.2007 no virus found
Fortinet 2.85.0.0 02.21.2007 no virus found
F-Prot 4.2.1.29 02.21.2007 no virus found
F-Secure 6.70.13030.0 02.21.2007 no virus found
Ikarus T3.1.0.31 02.21.2007 no virus found
Kaspersky 4.0.2.24 02.21.2007 no virus found
McAfee 4968 02.21.2007 no virus found
Microsoft 1.2204 02.21.2007 no virus found
NOD32v2 2073 02.21.2007 no virus found
Norman 5.80.02 02.21.2007 no virus found
Panda 9.0.0.4 02.21.2007 Suspicious file
Prevx1 V2 02.21.2007 no virus found
Sophos 4.14.0 02.21.2007 no virus found
Sunbelt 2.2.907.0 02.17.2007 no virus found
Symantec 10 02.21.2007 no virus found
TheHacker 6.1.6.062 02.21.2007 no virus found
UNA 1.83 02.20.2007 no virus found
VBA32 3.11.2 02.20.2007 no virus found
VirusBuster 4.3.19:9 02.21.2007 no virus found

Aditional Information
File size: 74240 bytes
MD5: 382ffcba0e2526aab37d77f2a3fb84c5
SHA1: 8c13c87519bc103dd25933dbf08541dc8554bbd8
packers: UPX

--------------------------------------------------
jidajid.dll.bak

Antivirus Version Update Result
AntiVir 7.3.1.37 02.21.2007 TR/Dldr.ConHook.Gen
Authentium 4.93.8 02.21.2007 no virus found
Avast 4.7.936.0 02.21.2007 no virus found
AVG 386 02.21.2007 no virus found
BitDefender 7.2 02.21.2007 no virus found
CAT-QuickHeal 9.00 02.21.2007 no virus found
ClamAV devel-20060426 02.21.2007 no virus found
DrWeb 4.33 02.21.2007 no virus found
eSafe 7.0.14.0 02.21.2007 Suspicious Trojan/Worm
eTrust-Vet 30.4.3417 02.21.2007 no virus found
Ewido 4.0 02.21.2007 no virus found
FileAdvisor 1 02.21.2007 no virus found
Fortinet 2.85.0.0 02.21.2007 no virus found
F-Prot 4.2.1.29 02.21.2007 no virus found
F-Secure 6.70.13030.0 02.21.2007 no virus found
Ikarus T3.1.0.31 02.21.2007 no virus found
Kaspersky 4.0.2.24 02.21.2007 no virus found
McAfee 4968 02.21.2007 no virus found
Microsoft 1.2204 02.21.2007 no virus found
NOD32v2 2073 02.21.2007 no virus found
Norman 5.80.02 02.21.2007 no virus found
Panda 9.0.0.4 02.21.2007 Suspicious file

Aditional Information
File size: 81920 bytes
MD5: a991f255074ed6dbbbba50b997cdebfa
SHA1: cc5414805d13347d4c905a94c07826bc589144dd

Blacklight hab ich runtegeladen und ausgeführt aber nachdem ich auf der ersten Seite "next" gedrückt habe ist nicht mehr viel passiert. "blbeta.exe" läuft zwar laut Task Manager aber das Programm ist nicht in der Programmliste aufgelistet. Im Ordner in den ich den exe-filde kopiert habe ist nur ein kleiner Log-file:

02/21/07 17:58:54 [info]: BlackLight Engine 1.0.55 initialized
02/21/07 17:58:54 [info]: OS: 5.1 build 2600 (Service Pack 2)
02/21/07 17:58:54 [Note]: 7019 4
02/21/07 17:58:54 [Note]: 7005 0

ich hoffe ihr könnt mir mit diesen Infos weiterhelfen.

Danke

Stefan

austria3 · 22.02.2007, 19:42

wie geht's jetzt weiter? was soll ich tun?

Stefan

cosinus · 22.02.2007, 20:32

Hast du die von mir erwähnten Dateien auch mit killbox gelöscht? Wenn ja dürften die erstmal nur inaktiv auf der Platte liegen. Mach mal einen Check mit eScan, folge dem Link in meiner Signatur.
Poste bitte auch mal ein neues HijackThis Logfile.
BTW: Wenn du ein wirklich sauberes System wieder haben willst, solltest du neu aufsetzen. Bei der Bereinigung besteht immer die Gefahr, dass nicht alle Malware entfernt wird, auch wenn nichts Offensichtliches mehr zu finden ist.

austria3 · 23.02.2007, 19:58

Also die von dir erwähnten Dateien hab ich per Killbox verschoben, hab aber erstmal nix am Problem geändert. Danach eScan nach Anleitung runtergeladen und Scan laufen lassen mit dem kleinen Unterschied dass bei mir nur den Button "Scan and Clean" gab und nicht wie in der anleitung "Scan" aber nachdem der einzige empfohlene Ausweg sowieso formate C: wars dann eh schon egal.

eScan Log:

Fri Feb 23 17:23:23 2007 => MWAV in SPECIAL PROMOTION MODE.
Fri Feb 23 17:23:23 2007 => **********************************************************
Fri Feb 23 17:23:23 2007 => MicroWorld Anti Virus & Spyware Toolkit Utility.
Fri Feb 23 17:23:23 2007 => Copyright © 2003-2006, MicroWorld Technologies Inc.
Fri Feb 23 17:23:23 2007 => **********************************************************
Fri Feb 23 17:23:23 2007 => Source: C:\DOKUME~1\n\EIGENE~1\mwav.exe
Fri Feb 23 17:23:23 2007 => Version 9.1.6 (C:\DOKUME~1\\LOKALE~1\Temp\mexe.com)
Fri Feb 23 17:23:23 2007 => Log File: C:\DOKUME~1\\LOKALE~1\Temp\MWAV.LOG
Fri Feb 23 17:23:23 2007 => MWAV Registered: TRUE.
Fri Feb 23 17:23:23 2007 => User Account:
Fri Feb 23 17:23:23 2007 => OS Type: Windows Workstation
Fri Feb 23 17:23:23 2007 => OS: Windows XP
Fri Feb 23 17:23:23 2007 => Ver: Service Pack 2 (Build 2600)
Fri Feb 23 17:23:23 2007 => Windows Root Folder: C:\WINDOWS
Fri Feb 23 17:23:23 2007 => Windows Sys32 Folder: C:\WINDOWS\system32
Fri Feb 23 17:23:23 2007 => Local Fixed Drives: c:\,e:\,f:\
Fri Feb 23 17:23:23 2007 => MWAV Mode: Scan and Clean files (for viruses, adware and spyware).
Fri Feb 23 17:23:23 2007 => Latest Date of files inside MWAV: 21 Feb 2007 12:06:0.
Fri Feb 23 17:23:25 2007 => AV Library Loaded...
Fri Feb 23 17:23:25 2007 => MWAV doing self scanning...
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\Getvlist.exe
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\main.avi
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\virus.avi
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\ScanningProcess.exe
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\Kave.dll
Fri Feb 23 17:23:25 2007 => Scanning File C:\DOKUME~1\\LOKALE~1\Temp\prloader.dll
Fri Feb 23 17:23:25 2007 => MWAV files are clean.
Fri Feb 23 17:23:32 2007 => Virus Database Date: 2/21/2007
Fri Feb 23 17:23:32 2007 => Virus Database Count: 271515
Fri Feb 23 17:23:59 2007 => Downloading AntiVirus and Anti-Spyware Databases...
Fri Feb 23 17:24:23 2007 => Downloads Successful...
Fri Feb 23 17:24:28 2007 => Possible Error In InsertIntoDB of value [{661173ee-fa31-4769-97d4-b556b5d09bda}]...
Fri Feb 23 17:24:28 2007 => InsertIntoDBFile Err: the key is unduplicated
Fri Feb 23 17:24:28 2007 => Possible Error In InsertIntoDB of value [spydawn]...
Fri Feb 23 17:24:28 2007 => InsertIntoDBFile Err: the key is unduplicated
Fri Feb 23 17:24:28 2007 => Possible Error In InsertIntoDB of value [%programfiles%\spydawn\spydawn.exe]...
Fri Feb 23 17:24:28 2007 => InsertIntoDBFile Err: the key is unduplicated
Fri Feb 23 17:24:28 2007 => Indexed Spyware Databases Successfully Created...
Fri Feb 23 17:24:30 2007 => Reload of AntiVirus Signatures successfully done.
Fri Feb 23 17:24:30 2007 => Virus Database Date: 2/23/2007
Fri Feb 23 17:24:30 2007 => Virus Database Count: 272710
Fri Feb 23 17:24:48 2007 => Uninitializing Scanner (3)...
Fri Feb 23 17:24:53 2007 => Freeing Libraries (3)...
Fri Feb 23 17:24:53 2007 => AV Library Unloaded (3)...
Fri Feb 23 17:39:31 2007 => MWAV in SPECIAL PROMOTION MODE.
Fri Feb 23 17:39:32 2007 => **********************************************************
Fri Feb 23 17:39:32 2007 => MicroWorld Anti Virus & Spyware Toolkit Utility.
Fri Feb 23 17:39:32 2007 => Copyright © 2003-2006, MicroWorld Technologies Inc.
Fri Feb 23 17:39:32 2007 => **********************************************************
Fri Feb 23 17:39:32 2007 => Source: C:\DOKUME~1\*\EIGENE~1\mwav.exe
Fri Feb 23 17:39:32 2007 => Version 9.1.6 (C:\DOKUME~1\*\LOKALE~1\Temp\mexe.com)
Fri Feb 23 17:39:32 2007 => Log File: C:\DOKUME~1\*\LOKALE~1\Temp\MWAV.LOG
Fri Feb 23 17:39:32 2007 => MWAV Registered: TRUE.
Fri Feb 23 17:39:32 2007 => User Account: *
Fri Feb 23 17:39:32 2007 => OS Type: Windows Workstation
Fri Feb 23 17:39:32 2007 => OS: Windows XP
Fri Feb 23 17:39:32 2007 => Ver: Service Pack 2 (Build 2600)
Fri Feb 23 17:39:32 2007 => Windows Root Folder: C:\WINDOWS
Fri Feb 23 17:39:32 2007 => Windows Sys32 Folder: C:\WINDOWS\system32
Fri Feb 23 17:39:32 2007 => Local Fixed Drives: c:\,e:\,f:\
Fri Feb 23 17:39:32 2007 => MWAV Mode: Scan and Clean files (for viruses, adware and spyware).
Fri Feb 23 17:39:32 2007 => Latest Date of files inside MWAV: 23 Feb 2007 17:22:0.
Fri Feb 23 17:39:34 2007 => AV Library Loaded...
Fri Feb 23 17:39:34 2007 => MWAV doing self scanning...
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\Getvlist.exe
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\main.avi
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\virus.avi
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\ScanningProcess.exe
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\Kave.dll
Fri Feb 23 17:39:34 2007 => Scanning File C:\DOKUME~1\*\LOKALE~1\Temp\prloader.dll
Fri Feb 23 17:39:34 2007 => MWAV files are clean.
Fri Feb 23 17:39:35 2007 => Virus Database Date: 2/23/2007
Fri Feb 23 17:39:35 2007 => Virus Database Count: 272679

Fri Feb 23 17:40:04 2007 => **********************************************************
Fri Feb 23 17:40:04 2007 => MicroWorld Anti Virus & Spyware Toolkit Utility.
Fri Feb 23 17:40:04 2007 => Copyright © 2003-2006, MicroWorld Technologies Inc.
Fri Feb 23 17:40:04 2007 =>
Fri Feb 23 17:40:04 2007 => Support: support@mwti.net
Fri Feb 23 17:40:04 2007 => Web: http://*.mwti.net
Fri Feb 23 17:40:04 2007 => **********************************************************
Fri Feb 23 17:40:04 2007 => Version 9.1.6 (C:\DOKUME~1\*\LOKALE~1\Temp\mexe.com)
Fri Feb 23 17:40:04 2007 => Log File: C:\DOKUME~1\*\LOKALE~1\Temp\MWAV.LOG
Fri Feb 23 17:40:04 2007 => User Account: *
Fri Feb 23 17:40:04 2007 => Windows Root Folder: C:\WINDOWS
Fri Feb 23 17:40:04 2007 => Windows Sys32 Folder: C:\WINDOWS\system32
Fri Feb 23 17:40:04 2007 => OS: Windows XP
Fri Feb 23 17:40:04 2007 => Ver: Service Pack 2 (Build 2600)
Fri Feb 23 17:40:04 2007 => Latest Date of files inside MWAV: 23 Feb 2007 17:22:0.

Fri Feb 23 17:40:04 2007 => Options Selected by User:
Fri Feb 23 17:40:04 2007 => Memory Check: Enabled
Fri Feb 23 17:40:04 2007 => Registry Check: Enabled
Fri Feb 23 17:40:04 2007 => StartUp Folder Check: Disabled
Fri Feb 23 17:40:04 2007 => System Folder Check: Disabled
Fri Feb 23 17:40:04 2007 => System Area Check: Disabled
Fri Feb 23 17:40:04 2007 => Services Check: Enabled
Fri Feb 23 17:40:04 2007 => Drive Check: Disabled
Fri Feb 23 17:40:04 2007 => All Drive Check :Enabled
Fri Feb 23 17:40:04 2007 => Folder Check: Disabled

Fri Feb 23 17:40:29 2007 => ERROR!!! Invalid Entry {3E898EEA-FEFA-451b-ACF2-7561F94B1191} = C:\WINDOWS\system32\ert.dll (in key Software\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler). Removing it.
Fri Feb 23 17:42:06 2007 => Invalid Entry DllName = appmgmts.dll (in key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{c6dc5466-785a-11d2-84d0-00c04fb169f7}). Deleting Registry Key {c6dc5466-785a-11d2-84d0-00c04fb169f7}...
Fri Feb 23 17:42:20 2007 => ERROR!!! Invalid Entry system32\drivers\InCDFs.sys. Removing SYSTEM\CurrentControlSet\Services\InCDFs...
Fri Feb 23 17:42:20 2007 => ERROR!!! Invalid Entry system32\drivers\InCDPass.sys. Removing SYSTEM\CurrentControlSet\Services\InCDPass...
Fri Feb 23 17:42:20 2007 => ERROR!!! Invalid Entry system32\drivers\InCDRm.sys. Removing SYSTEM\CurrentControlSet\Services\InCDRm...
Fri Feb 23 17:42:23 2007 => ERROR!!! Invalid Entry \??\C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20060823.066\NAVENG.SYS. Removing SYSTEM\CurrentControlSet\Services\NAVENG...
Fri Feb 23 17:42:23 2007 => ERROR!!! Invalid Entry \??\C:\PROGRA~1\GEMEIN~1\SYMANT~1\VIRUSD~1\20060823.066\NAVEX15.SYS. Removing SYSTEM\CurrentControlSet\Services\NAVEX15...

Fri Feb 23 17:42:37 2007 => ***** Scanning Registry and File system for Adware/Spyware *****
Fri Feb 23 17:42:37 2007 => Loading Spyware Signatures from new External Database [Name: C:\DOKUME~1\*\LOKALE~1\Temp\spydb.avs, Size: 211465].
Fri Feb 23 17:42:37 2007 => Indexed Spyware Databases Successfully Created...

Fri Feb 23 17:42:40 2007 => Deleting Registry Key: HKCU\software\microsoft\windows\currentversion\explorer\menuorder\start menu2\programs\seekmo search assistant
Fri Feb 23 17:42:40 2007 => Offending Key found: HKCU\software\microsoft\windows\currentversion\explorer\menuorder\start menu2\programs\seekmo search assistant !!!
Fri Feb 23 17:42:40 2007 => Object "seekmo Adware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:42:49 2007 => Offending file found: C:\DOKUME~1\*\FAVORI~1\shopping\ebay.url
Fri Feb 23 17:42:49 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Entries Removed.
Fri Feb 23 17:42:49 2007 => Object "ezula Spyware/Adware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:42:50 2007 => Offending file found: C:\DOKUME~1\*\EIGENE~1\EIGENE~1\NEUERO~1\shopping\ebay.url
Fri Feb 23 17:42:50 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Entries Removed.
Fri Feb 23 17:42:50 2007 => Object "ezula Spyware/Adware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:43:00 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\DOKUME~1\NERO7~1\NERO7P~1\redist\tts\msagent.exe
Fri Feb 23 17:43:00 2007 => System found infected with bonzibuddy Spyware/Adware (msagent.exe)! Action taken: Entries Removed.
Fri Feb 23 17:43:00 2007 => Object "bonzibuddy Spyware/Adware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:43:00 2007 => Offending file found: C:\DOKUME~1\ALLUSE~1\DOKUME~1\NERO7~1\NERO7P~1\redist\tts\spchapi.exe
Fri Feb 23 17:43:00 2007 => System found infected with bonzibuddy Spyware/Adware (spchapi.exe)! Action taken: Entries Removed.
Fri Feb 23 17:43:00 2007 => Object "bonzibuddy Spyware/Adware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:43:02 2007 => Offending file found: C:\WINDOWS\unvise32.exe
Fri Feb 23 17:43:02 2007 => System found infected with spylax Corrupted Adware/Spyware (C:\WINDOWS\unvise32.exe)! Action taken: Entries Removed.
Fri Feb 23 17:43:02 2007 => Object "spylax Corrupted Adware/Spyware" found in File System! Action Taken: Entries Removed.

Fri Feb 23 17:43:07 2007 => Checking CLSID Reference Entries...
Fri Feb 23 17:43:07 2007 => Entry "HKCR\Adobe.Illustrator.dwg" refers to invalid object "{C0ED15F0-61BB-11d3-B6CA-00C04F6A0D06}". Action Taken: Entries Removed.

Fri Feb 23 17:43:07 2007 => Entry "HKCR\Adobe.Illustrator.dxf" refers to invalid object "{C0ED15F0-61BB-11d3-B6CA-00C04F6A0D06}". Action Taken: Entries Removed.

Fri Feb 23 17:43:07 2007 => Entry "HKCR\Adobe.Illustrator.pict" refers to invalid object "{C0ED15F0-61BB-11d3-B6CA-00C04F6A0D06}". Action Taken: Entries Removed.

Fri Feb 23 17:43:08 2007 => Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: Entries Removed.

Fri Feb 23 17:43:08 2007 => Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: Entries Removed.

Fri Feb 23 17:43:09 2007 => Entry "HKCR\ImagXpr5.Catalog" refers to invalid object "{BC75F3BF-4D8C-C79F-CFA9-AB1CE88DF358}". Action Taken: Entries Removed.

Fri Feb 23 17:43:09 2007 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: Entries Removed.

Fri Feb 23 17:43:09 2007 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: Entries Removed.

Fri Feb 23 17:43:09 2007 => Entry "HKCR\MediaTechnologyGroup.CDPass" refers to invalid object "{4F09379D-34EF-4A29-8336-20C7473ED3BA}". Action Taken: Entries Removed.

Fri Feb 23 17:43:11 2007 => Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: Entries Removed.

Fri Feb 23 17:43:11 2007 => Entry "HKCR\WholeSecurity.CATEEAx" refers to invalid object "{3ba494b1-d507-4c11-9bda-d47e1a65dfcf}". Action Taken: Entries Removed.

Fri Feb 23 17:43:11 2007 => Checking Module Usage Entries...
Fri Feb 23 17:43:11 2007 => Checking User Trusted External App Entries...
Fri Feb 23 17:43:11 2007 => Entry "HKCU\Software\Netscape\Netscape Navigator\User Trusted External Applications" refers to invalid object "". Action Taken: Entries Removed.

Fri Feb 23 17:43:11 2007 => Checking Shared DLL Entries...
Fri Feb 23 17:43:13 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\unvise32.exe". Action Taken: Entries Removed.

Fri Feb 23 17:43:13 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\MSXML3A.DLL". Action Taken: Entries Removed.

Fri Feb 23 17:43:13 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: Entries Removed.

Fri Feb 23 17:43:15 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\Real\GToolbar\BarControl.dll". Action Taken: Entries Removed.

Fri Feb 23 17:43:16 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\drivers\vsdatant.sys". Action Taken: Entries Removed.

Fri Feb 23 17:43:16 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\aeiqbtmy.exe". Action Taken: Entries Removed.

Fri Feb 23 17:43:17 2007 => Checking Installer Entries...
Fri Feb 23 17:43:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Dell\Media Experience\Extras\". Action Taken: Entries Removed.

Fri Feb 23 17:43:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Norton Internet Security\". Action Taken: Entries Removed.

Fri Feb 23 17:43:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Norton Internet Security\Norton AntiVirus\". Action Taken: Entries Removed.

Fri Feb 23 17:43:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jasc Software Inc\Paint Shop Pro Studio\". Action Taken: Entries Removed.

Fri Feb 23 17:43:18 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jasc Software Inc\". Action Taken: Entries Removed.

Fri Feb 23 17:43:20 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\*\Eigene Dateien\My PSP8 Files\Skripts (eingeschränkt)\". Action Taken: Entries Removed.

Fri Feb 23 17:43:20 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\*\Eigene Dateien\My PSP8 Files\". Action Taken: Entries Removed.

Fri Feb 23 17:43:24 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Adobe\Adobe Version Cue CS2\plugin\". Action Taken: Entries Removed.

Fri Feb 23 17:43:24 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Adobe\Adobe Version Cue CS2\__installer__\". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Checking Shared Tools Entries...
Fri Feb 23 17:43:32 2007 => Checking File Extension Entries...
Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".bak". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".CCD". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dmx". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".doc&m_action=view". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dwf". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".gpk". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".lic". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".php?attachmentid=2822". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".prn". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rte". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sln". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".THM". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".tmp". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Checking Application Cache Entries...
Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "GlobalSat SDGPS4bit". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ICQLite". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "LiveReg". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Mozilla Firefox (0.9.3)". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SymSetup.{C6F5B6CF-609C-428E-876F-CA83176C021B}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{4192EAC0-6B36-4723-B216-D0E86E7757AC}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{4757E865-0292-4E04-940D-9C51052A5DD6}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{503AA035-41E2-4858-B31F-1E49AC66C309}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{81A34902-9D0B-4920-A25C-4CDC5D14B328}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{AC76BA86-0000-0000-0000-6028747ADE01}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{AC76BA86-7AD7-1031-7B44-A00000000001}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{CFF8E668-1954-44CC-A342-FED2CC0601CA}". Action Taken: Entries Removed.

Fri Feb 23 17:43:32 2007 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{F011B8F1-BCCD-4E73-84F8-CB2F2D258755}". Action Taken: Entries Removed.

Fri Feb 23 17:43:34 2007 => Clearing Internet Cache as Spyware/Adware found in system...
Fri Feb 23 17:43:37 2007 => Clearing Temporary sub-folders as Spyware/Adware found in system...
Fri Feb 23 17:43:41 2007 => ** Value in HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\main/Start Page = http://*.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
Fri Feb 23 17:43:41 2007 => ** Value in HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main/Start Page = http://*.google.com/
Fri Feb 23 17:43:41 2007 => ** Value in HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\main/Start Page = http://*.euro.dell.com/countries/at/dea/gen/default.htm

Fri Feb 23 17:43:41 2007 => ***** Scanning All Drives *****
Fri Feb 23 17:43:41 2007 => Scanning C:\ Drive
Fri Feb 23 17:43:41 2007 => Scanning Folder: C:\*.*
Fri Feb 23 17:43:42 2007 => Scanning Folder: C:\!KillBox\*.*
Fri Feb 23 17:43:42 2007 => Scanning File C:\!KillBox\jidajid.dll
Fri Feb 23 17:43:42 2007 => Scanning File C:\!KillBox\jidajid.dll.bak
Fri Feb 23 17:43:42 2007 => Scanning Folder: C:\!KillBox\Logs\*.*
Fri Feb 23 17:43:42 2007 => Scanning File C:\!KillBox\Logs\kb.log
Fri Feb 23 17:43:42 2007 => Scanning File C:\!KillBox\mshearts.exe
Fri Feb 23 17:43:42 2007 => Scanning File C:\!KillBox\MS_update_0612_KB74062.exe
Fri Feb 23 17:43:43 2007 => File C:\!KillBox\MS_update_0612_KB74062.exe//ASPack infected by "Trojan-Downloader.Win32.Murlo.ex" Virus! Action Taken: File Deleted.
Fri Feb 23 17:59:44 2007 => Scanning E:\ Drive

Fri Feb 23 17:59:44 2007 => ***** Scanning complete. *****

Fri Feb 23 17:59:44 2007 => Total Objects Scanned: 24969
Fri Feb 23 17:59:44 2007 => Total Critical Objects: 7
Fri Feb 23 17:59:44 2007 => Total Disinfected Objects: 0
Fri Feb 23 17:59:44 2007 => Total Objects Renamed: 0
Fri Feb 23 17:59:44 2007 => Total Deleted Objects: 61
Fri Feb 23 17:59:44 2007 => Total Errors: 61
Fri Feb 23 17:59:44 2007 => Time Elapsed: 00:17:44
Fri Feb 23 17:59:44 2007 => Virus Database Date: 2/23/2007
Fri Feb 23 17:59:45 2007 => Virus Database Count: 272679

Fri Feb 23 17:59:45 2007 => Scan Completed.

austria3 · 23.02.2007, 19:59

und als Abschluss:

Logfile of HijackThis v1.99.1
Scan saved at 18:06:53, on 23.02.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\Programme\Intel\Wireless\Bin\WLKeeper.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programme\Apoint\Apoint.exe
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programme\Apoint\Apntex.exe
C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\CNOServerLauncher.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\BarrMon.exe
C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\Digital Line Detect\DLG.exe
C:\PROGRA~1\MAGICM~1\MAGIC-~1.94B\Magic.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\DOKUME~1\*\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {161B98EA-C767-4204-AC01-7ECC6E85D6F6} - C:\WINDOWS\system32\jidajid.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [DMXLauncher] C:\Programme\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnOServerLauncher] CNOServerLauncher.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programme\Norton AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Barricade-Monitor] C:\WINDOWS\BarrMon.exe "NoSound"
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Programme\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Verknüpfung mit *.magic.lnk = ?
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://*-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {46C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDPass Class) - http://*.cdpass.com/cdkey/CDPass.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://*-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O17 - HKLM\System\CS3\Services\Tcpip\..\{1D503787-C84C-4487-A7CF-5F4808079B2F}: NameServer = 10.0.0.200,195.3.96.68
O20 - Winlogon Notify: hfrkhnpk - C:\WINDOWS\SYSTEM32\jidajid.dll
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Symantec IS Kennwortprüfung (ISPwdSvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe

Internet Explorer funktioniert wieder
Norton anti Virus auch aber wenn ich Live Update ausführe bekomme ich beim Installieren der Updates einen blauen Bildschirm !!!! Soll ich das Programm neu installieren?

Danke für eure Hilfe

Stefan

irrlicht · 23.02.2007, 21:53

Hallo,
ein "Blue Screen verspricht nix gutes...

Dabei steht eine Meldung.Die solltest du mal posten.Wenn er nach dem Bluescreen neu hochfährt,kannst du das folgendermaßen abstellen :Start > systemsteuerung > Leistung und Wartung > System > Reiter "erweitert" > Starten und wiederherstellen > Einstellungen > Haken raus bei "automatisch Neustart durchführen"
Dann provozierst du nochmal diesen blauen Bildschirm.Dieser wird dann stehen bleiben und du kannst in aller Ruhe die Meldung komplett abschreiben und posten.
Deinen EScan hast du übrigens verbockt.Du hast dir die Testversion runter geladen......
Irrlicht

kein Internet Explorer und Norton Antivirus

Log-Analyse und Auswertung: kein Internet Explorer und Norton Antivirus