| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.07.2008, 22:30
| #1 |
 |  TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hallo liebe Experte, ich hoffe Ihre könnt mir beim Auswerten der nachstehenden Logfile behilflich sein. Ich habe mich bemüht alles richtig zu editieren. Ich habe seit gestern Probleme mit dem PC. Habe CC Cleaner, Antivir und Ad Aware laufen lassen. Dort wurde Malware und u. a. die im Betreff genannten Würmer entdeckt. Habe Sie in die Quarantäne geschoben und anschließend gelöscht. Da ich wirklich weniger als 0 Ahnung habe, wäre ich für eure Hilfe sehr dankbar. Mein Betriebssystem ist Windows Vista. Seit gut 2 Stunden kann ich auf den Windows Explorer nicht mehr zugereifen. Kein Ordner lässt sich öffnen, kein Arbeitsplatz, keine Systemsteuerung. Es kommt folgende Meldung: Windows Explorer funktioniert nicht mehr. Dann verschwindem kurz die Desktopsymbole - 3 Sek. später sind sie wieder alle sichtbar. Hier die Logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:21:12, on 11.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Windows\System32\rundll32.exe C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe C:\Windows\explorer.exe C:\Program Files\TuneUp Utilities 2008\Integrator.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe C:\Program Files\TuneUp Utilities 2008\RepairWizard.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: (no name) - {23923995-DE67-47FA-93E1-B83F9C8E7056} - C:\Windows\system32\fccDTNgD.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: IE Site Blocker - {6DDBF417-0774-46AD-940B-6A4D9A039407} - C:\Windows\system32\navflt.dll (file missing) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: VideoCodec Class - {926A61C9-5C20-4583-ACA7-ACE21088816E} - C:\Windows\system32\RichVideoCodec.dll O2 - BHO: AswPlugin Class - {949859A7-EB1F-400D-BDBC-C48238BDF788} - C:\Windows\system32\AswBHO.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O3 - Toolbar: (no name) - {695AD9B9-B97E-4F91-8B6F-B1BD73937505} - (no file) O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuvSliJC.dll,#1 O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [301030b7] rundll32.exe "C:\Windows\system32\jtgdtpyw.dll",b O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O21 - SSODL: fsrpknov - {3AE32571-9FFC-42D5-BBB9-1B8F59F5C4D6} - C:\Windows\fsrpknov.dll O21 - SSODL: fdxbameg - {43F19278-7D91-4F42-AD15-BD26270CA9AC} - (no file) O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe Vielen Dank schon mal. Das Wurm-Opfer |
|
12.07.2008, 11:23
| #2 |
  | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hi und
__________________ Ja du hast so ziemlich viel Mist auf deinem System... Bitte lass als erstes Malwarebytes laufen, lass alles löschen was er findet (log von Malwarebytes bitte posten) und erstelle ein neues HijackThis Logfile  Weiter erstellst du bitte mit RunScanner ein Logfile und postest es ebenfalls
__________________ |
|
12.07.2008, 15:08
| #3 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hallo,
__________________vielen Dank für Deine Hilfe. Hier die logfiles: Malwarebytes' Anti-Malware 1.20 Datenbank Version: 941 Windows 6.0.6000 15:09:42 12.07.2008 mbam-log-7-12-2008 (15-09-21).txt Scan Art: Komplett Scan (C:\|D:\|) Objekte gescannt: 222527 Scan Dauer: 1 hour(s), 37 minute(s), 30 second(s) Infizierte Speicher Prozesse: 0 Infizierte Speicher Module: 1 Infizierte Registrierungsschlüssel: 16 Infizierte Registrierungswerte: 6 Infizierte Datei Objekte der Registrierung: 1 Infizierte Verzeichnisse: 2 Infizierte Dateien: 28 Infizierte Speicher Prozesse: (Keine Malware Objekte gefunden) Infizierte Speicher Module: C:\Windows\System32\fccDTNgD.dll (Trojan.Vundo) -> No action taken. Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\TypeLib\{98d1e2a4-d1db-4a4a-9a73-c94d3eb4dba1} (Trojan.BHO) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{949859a7-eb1f-400d-bdbc-c48238bdf788} (Trojan.BHO) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{949859a7-eb1f-400d-bdbc-c48238bdf788} (Trojan.BHO) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{6cf0a05e-7d6b-4e00-b836-b3f23513657c} (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{94f65bb8-ddec-4b1a-9809-8b9e3f2b440e} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{94f65bb8-ddec-4b1a-9809-8b9e3f2b440e} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3746f4bf-9fb7-41ef-922d-008e535cbfb2} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{3ae32571-9ffc-42d5-bbb9-1b8f59f5c4d6} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{454bdcf0-fb41-41da-9a31-fa8df17b043a} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{d078c29c-3d97-4c07-b820-84c9c68406d0} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\sqvgnrpx.bbst (Trojan.FakeAlert) -> No action taken. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\301030b7 (Trojan.Agent) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6cf0a05e-7d6b-4e00-b836-b3f23513657c} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fsrpknov (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\fdxbameg (Trojan.FakeAlert) -> No action taken. Infizierte Datei Objekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccdtngd -> No action taken. Infizierte Verzeichnisse: C:\Program Files\RichVideoCodec (Trojan.FakeAlert) -> No action taken. C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> No action taken. Infizierte Dateien: C:\Program Files\PCHealthCenter\5.exe (Rogue.Installer) -> No action taken. C:\Windows\erem.exe (Trojan.FakeAlert) -> No action taken. C:\Windows\System32\ezfgid.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\flqmsa.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\kfwftwdn.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\kfyllojy.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\lxhsle.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\mdmaenhb.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\nspgqxlq.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\oidyhwym.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\ppbahk.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\vrkwgj.dll (Trojan.Vundo) -> No action taken. C:\Program Files\RichVideoCodec\InstallRegerLib.dll (Trojan.FakeAlert) -> No action taken. C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> No action taken. C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> No action taken. C:\Windows\System32\AswBHO.dll (Trojan.BHO) -> No action taken. C:\Windows\System32\tuvSliJC.dll (Trojan.Agent) -> No action taken. C:\Users\Isabella\AppData\Local\Temp\xxyAQhHw.dll (Trojan.Agent) -> No action taken. C:\Windows\System32\ddcCUlLe.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\fccDTNgD.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\iIbcbaya.dll (Trojan.Vundo) -> No action taken. C:\Windows\System32\iIBsRLCV.dll (Trojan.Vundo) -> No action taken. C:\Windows\fsrpknov.dll (Trojan.FakeAlert) -> No action taken. Hier die RunScanner logfile: Runscanner logfile http://www.runscanner.net * = signed file - = file not found 000 General info ---------------- Computer name : ISABELLA-PC Creation time : 12.07.2008 15:58:19 Hosts <> 127.0.0.1 : 0 Hosts file location : %SystemRoot%\System32\drivers\etc IE version : 7.0.6000.16681 OS : Windows Vista (TM) Business OS Build : 6000 OS SP : RunScanner Version : 1.6.3.0 User Language : Deutsch (Deutschland) User rights : Administrator Windows folder : C:\Windows 001 Running processes --------------------- * c:\program files\adobe\acrobat 8.0\acrobat\acrotray.exe (Adobe Systems Inc.) c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe (Macrovision Europe Ltd.) * c:\program files\lavasoft\ad-aware\aawservice.exe (Lavasoft) c:\program files\avira\antivir personaledition classic\avguard.exe (Avira GmbH) c:\program files\avira\antivir personaledition classic\sched.exe (Avira GmbH) c:\program files\avira\antivir personaledition classic\avgnt.exe (Avira GmbH) * c:\windows\system32\services.exe (Microsoft Corporation) * c:\windows\system32\taskeng.exe (Microsoft Corporation) * c:\windows\system32\taskeng.exe (Microsoft Corporation) * c:\program files\alwil software\avast4\ashserv.exe (ALWIL Software) * c:\program files\alwil software\avast4\aswupdsv.exe (ALWIL Software) * c:\program files\alwil software\avast4\ashmaisv.exe (ALWIL Software) * c:\program files\alwil software\avast4\ashdisp.exe (ALWIL Software) * c:\program files\alwil software\avast4\ashwebsv.exe (ALWIL Software) c:\progra~1\grisoft\avg7\avgamsvr.exe (GRISOFT, s.r.o.) c:\progra~1\grisoft\avg7\avgrssvc.exe (GRISOFT, s.r.o.) c:\progra~1\grisoft\avg7\avgrssvc.exe (GRISOFT, s.r.o.) c:\progra~1\grisoft\avg7\avgupsvc.exe (GRISOFT, s.r.o.) c:\program files\bonjour\mdnsresponder.exe (Apple Computer, Inc.) * c:\windows\system32\csrss.exe (Microsoft Corporation) * c:\windows\system32\csrss.exe (Microsoft Corporation) * c:\windows\system32\dwm.exe (Microsoft Corporation) * c:\program files\google\googletoolbarnotifier\1.2.1128.5462\googletoolbarnotifier.exe (Google Inc.) c:\program files\avira\antivir personaledition classic\guardgui.exe (Avira GmbH) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\svchost.exe (Microsoft Corporation) * c:\windows\system32\lsass.exe (Microsoft Corporation) * c:\windows\system32\lsm.exe (Microsoft Corporation) * c:\programdata\macrovision\flexnet connect\6\isuspm.exe (Macrovision Corporation) * c:\windows\system32\searchindexer.exe (Microsoft Corporation) * c:\windows\system32\vssvc.exe (Microsoft Corporation) * c:\windows\system32\slsvc.exe (Microsoft Corporation) c:\program files\common files\nokia\mpapi\mpapi3s.exe (Nokia Corporation) c:\program files\pc connectivity solution\transports\nclrssrv.exe c:\program files\pc connectivity solution\transports\nclusbsrv.exe c:\program files\nokia\nokia pc suite 6\pcsuite.exe (Nokia) c:\program files\scansoft\paperport\pptd40nt.exe (ScanSoft, Inc.) c:\program files\nokia\nokia pc suite 6\pcsync2.exe (Time Information Services Ltd.) * c:\program files\common files\real\update_ob\realsched.exe (RealNetworks, Inc.) * c:\users\isabella\desktop\neuer ordner\desktop\neuer ordner\desktop\neuer ordner\desktop\runscanner.exe (Runscanner.net) c:\program files\pc connectivity solution\servicelayer.exe (Nokia.) * c:\windows\system32\spoolsv.exe (Microsoft Corporation) * c:\program files\teamviewer3\teamviewer_host.exe (TeamViewer GmbH) c:\program files\winamp\winampa.exe * c:\program files\windows defender\msascui.exe (Microsoft Corporation) * c:\windows\system32\wudfhost.exe (Microsoft Corporation) * C:\Windows\system32\audiodg.exe (Microsoft Corporation) * c:\windows\system32\smss.exe (Microsoft Corporation) * c:\windows\system32\wuauclt.exe (Microsoft Corporation) * c:\windows\system32\winlogon.exe (Microsoft Corporation) * c:\windows\explorer.exe (Microsoft Corporation) * c:\windows\system32\wininit.exe (Microsoft Corporation) 002 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys) ----------------------------------------------------------------- c:\progra~1\common~1\adobe\adobev~1\server\bin\versio~2.exe (Adobe Systems Incorporated) * c:\progra~1\alwils~1\avast4\ashdisp.exe (ALWIL Software) c:\program files\avira\antivir personaledition classic\avgnt.exe (Avira GmbH) c:\program files\scansoft\paperport\indexsearch.exe (ScanSoft, Inc.) * c:\program files\malwarebytes' anti-malware\mbam.exe (Malwarebytes Corporation) c:\program files\scansoft\paperport\pptd40nt.exe (ScanSoft, Inc.) c:\program files\common files\scansoft shared\ssbkgdupdate\ssbkgdupdate.exe (Scansoft, Inc.) * c:\program files\common files\real\update_ob\realsched.exe (RealNetworks, Inc.) c:\program files\winamp\winampa.exe 003 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run (+subkeys) ----------------------------------------------------------------- * c:\program files\ccleaner\ccleaner.exe (Piriform Ltd) * c:\programdata\macrovision\flexnet connect\6\isuspm.exe (Macrovision Corporation) c:\program files\nokia\nokia pc suite 6\pcsync2.exe (Time Information Services Ltd.) c:\program files\nokia\nokia pc suite 6\pcsuite.exe (Nokia) - c:\program files\uniblue\registrybooster 2\startregistrybooster.exe 004 C:\Users\Isabella\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup ----------------------------------------------------------------------------------- c:\progra~1\common~1\adobe\calibr~1\adobeg~1.exe (Adobe Systems, Inc.) 007 %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup ------------------------------------------------------------------------------- c:\progra~1\common~1\adobe\calibr~1\adobeg~1.exe (Adobe Systems, Inc.) 008 Default user \Software\Microsoft\Windows\CurrentVersion\Run (+subkeys) -------------------------------------------------------------------------- c:\progra~1\grisoft\avg7\avgw.exe (GRISOFT, s.r.o.) 009 System user\Software\Microsoft\Windows\CurrentVersion\Run (+subkeys) ------------------------------------------------------------------------ c:\progra~1\grisoft\avg7\avgw.exe (GRISOFT, s.r.o.) 010 HKLM\SYSTEM\CurrentControlSet\Services (Services) ----------------------------------------------------- c:\program files\bonjour\mdnsresponder.exe (##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##) * C:\Windows\system32\tuneupdefragservice.exe (@%SystemRoot%\System32\TuneUpDefragService.exe,-1) c:\program files\common files\adobe systems shared\service\adobelmsvc.exe (Adobe LM Service) * c:\program files\alwil software\avast4\ashserv.exe (avast! Antivirus) * c:\program files\alwil software\avast4\aswupdsv.exe (avast! iAVS4 Control Service) * c:\program files\alwil software\avast4\ashmaisv.exe (avast! Mail Scanner) * c:\program files\alwil software\avast4\ashwebsv.exe (avast! Web Scanner) c:\progra~1\grisoft\avg7\avgamsvr.exe (AVG7 Alert Manager Server) c:\progra~1\grisoft\avg7\avgrssvc.exe (AVG7 Resident Shield Service) c:\progra~1\grisoft\avg7\avgupsvc.exe (AVG7 Update Service) c:\program files\avira\antivir personaledition classic\avguard.exe (Avira AntiVir Personal – Free Antivirus Guard) c:\program files\avira\antivir personaledition classic\sched.exe (Avira AntiVir Personal – Free Antivirus Planer) c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe (FLEXnet Licensing Service) * c:\program files\lavasoft\ad-aware\aawservice.exe (Lavasoft Ad-Aware Service) - c:\program files\maxtor\maxtor backup\maxbackserviceint.exe (MaxBackServiceInt) c:\program files\pc connectivity solution\servicelayer.exe (ServiceLayer) * c:\program files\teamviewer3\teamviewer_host.exe (TeamViewer 3) 011 HKLM\SYSTEM\CurrentControlSet\Services (drivers) ---------------------------------------------------- * C:\Windows\system32\drivers\aswfsblk.sys (aswFsBlk) * C:\Windows\system32\drivers\aswmonflt.sys (aswMonFlt) * c:\windows\system32\drivers\aswrdr.sys (aswRdr) * c:\windows\system32\drivers\aswtdi.sys (avast! Network Shield Support) * c:\windows\system32\drivers\aswsp.sys (avast! Self Protection) * c:\windows\system32\drivers\avgmfx86.sys (AVG Minifilter x86 Resident Driver) * c:\windows\system32\drivers\avgclean.sys (AVG7 Clean Driver) * c:\program files\avira\antivir personaledition classic\avgio.sys (avgio) * c:\program files\avira\antivir personaledition classic\avgntflt.sys (avgntflt) * C:\Windows\system32\drivers\avipbb.sys (avipbb) - c:\windows\system32\drivers\ipinip.sys (IP in IP Tunnel Driver) - c:\windows\system32\drivers\nwlnkflt.sys (IPX Traffic Filter Driver) - c:\windows\system32\drivers\nwlnkfwd.sys (IPX Traffic Forwarder Driver) C:\Windows\system32\drivers\nvstor.sys (nvstor) C:\Windows\system32\drivers\ssmdrv.sys (ssmdrv) 040 HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks ------------------------------------------------------------ * c:\program files\winamp toolbar\winamptb.dll (AOL LLC.) {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} 041 HKLM-HKCU\Software\Microsoft\Internet Explorer\Toolbar ---------------------------------------------------------- - c:\program files\adobe\ {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} * c:\program files\winamp toolbar\winamptb.dll (AOL LLC.) {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} 042 HKLM\Software\Microsoft\Internet Explorer\Extensions -------------------------------------------------------- GUID / CLSID not found {08B0E5C0-4FCB-11CF-AAA5-00401C608501} GUID / CLSID not found {2670000A-7350-4f3c-8081-5663EE0C6C49} GUID / CLSID not found {92780B25-18CC-41C8-B9BE-3C9C571A8263} 045 HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser ---------------------------------------------------------------- * c:\program files\winamp toolbar\winamptb.dll (AOL LLC.) {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} 052 HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects ---------------------------------------------------------------------------------- - c:\program files\adobe\ {074C1DC5-9320-4A9A-947D-C042949C6216} c:\windows\system32\fccdtngd.dll {94F65BB8-DDEC-4B1A-9809-8B9E3F2B440E} * c:\program files\winamp toolbar\winamptb.dll (AOL LLC.) {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} 061 HKLM-HCKU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved --------------------------------------------------------------------------------- * c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-460A-42C5-AE0C-81C61FFAEBC3} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} c:\program files\nokia\nokia pc suite 6\phonebrowser.dll (Nokia) {416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} c:\program files\avira\antivir personaledition classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} * c:\program files\real\realplayer\rpshell.dll (RealNetworks, Inc.) {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} * c:\progra~1\tuneup~1\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} * C:\Windows\system32\uxtuneup.dll (TuneUp Software GmbH) {44440D00-FF19-4AFC-B765-9A0970567D97} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 062 HKLM-HKCU\Software\Classes\Folder\Shellex\ColumnHandlers ------------------------------------------------------------ GUID / CLSID not found {7D4D6379-F301-4311-BEBA-E26EB0561882} c:\program files\common files\adobe\acrobat\activex\pdfshell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627} 063 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute --------------------------------------------------------------------- * C:\Windows\system32\lsdelete.exe 067 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify --------------------------------------------------------------------- C:\Windows\system32\avgwlntf.dll (GRISOFT, s.r.o.) 070 HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages --------------------------------------------------------------------- c:\windows\system32\fccdtngd.dll 073 %windir%\Tasks ------------------ 1-Klick-Wartung.job : c:\program files\tuneup utilities 2008\oneclickstarter.exe 100 Internet Explorer settings ------------------------------ Start Page HKCU : http://www.google.de/ 105 HKCU\Software\Microsoft\Internet Explorer\MenuExt ----------------------------------------------------- &Winamp Search : C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html An vorhandenes PDF anfügen : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html Ausgewählte Verknüpfungen in Adobe PDF konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html Auswahl in Adobe PDF konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html Auswahl in vorhandene PDF-Datei konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html In Adobe PDF konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html Nach Microsoft E&xel exportieren : res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 Verknüpfungsziel in Adobe PDF konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html Verknüpfungsziel in vorhandene PDF-Datei konvertieren : res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html 107 HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5 --------------------------------------------------------------------------------- c:\program files\bonjour\mdnsnsp.dll (Apple Computer, Inc.) 170 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ------------------------------------------------------------------------ {1e74c75d-518d-11dc-ae57-001921ef8f41} : K:\LaunchU3.exe {aa067442-0ca6-11dd-b688-001921ef8f41} : F:\starter.exe {df001920-0f7d-11dd-89e9-001921ef8f41} : F:\browsr95.exe 173 HKCR\*\shellex\ContextMenuHandlers -------------------------------------- * c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} c:\program files\avira\antivir personaledition classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} * c:\progra~1\tuneup~1\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 221 HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers ------------------------------------------------------- * c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} c:\program files\avira\antivir personaledition classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} * c:\progra~1\tuneup~1\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 223 HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers -------------------------------------------------------------------------- * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} 225 HKCU\Software\Classes\Folder\ShellEx\ContextMenuHandlers ------------------------------------------------------------ * c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24} * c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} c:\program files\grisoft\avg7\avgse.dll (GRISOFT, s.r.o.) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} * c:\program files\malwarebytes' anti-malware\mbamext.dll (Malwarebytes) {57CE581A-0CB6-4266-9CA0-19364C90A0B3} c:\program files\avira\antivir personaledition classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} c:\program files\avira\antivir personaledition classic\shlext.dll (Avira GmbH) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 227 HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers --------------------------------------------------------------- * c:\progra~1\tuneup~1\sdshelex-win32.dll (TuneUp Software GmbH) {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} c:\program files\winrar\rarext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} 231 HKLM\Software\Classes\Folder\Shellex\ColumnHandlers ------------------------------------------------------- GUID / CLSID not found NeroDigitalExt.NeroDigitalColumnHandler c:\program files\common files\adobe\acrobat\activex\pdfshell.dll (Adobe Systems, Inc.) PDF Column Info Bin schon sehr gespannt auf Deine Anwort. Und nochmals Danke. Das Wurm-Opfer |
|
12.07.2008, 15:29
| #4 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hier noch die HijackThis Logfile - leider mit etwas Verspätung - habe vor lauter Virus Fund Warnungen der Programme etwas zu kämpfen: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:28:07, on 12.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {94F65BB8-DDEC-4B1A-9809-8B9E3F2B440E} - C:\Windows\system32\fccDTNgD.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O3 - Toolbar: (no name) - {695AD9B9-B97E-4F91-8B6F-B1BD73937505} - (no file) O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe -- End of file - 11797 bytes |
|
12.07.2008, 19:10
| #5 | |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Ok Hast du die infizierten Datein usw. die Malwarebytes gefunden hat gelöscht? Bitte lade folgende Dateien bei VirusTotal hoch und poste das Ergebnis: C:\Windows\system32\fccDTNgD.dll Bitte fixe mit HijackThis folgende Einträge: O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O3 - Toolbar: (no name) - {695AD9B9-B97E-4F91-8B6F-B1BD73937505} - (no file)
__________________ Kein Support per PN Zitat:
|
|
12.07.2008, 19:17
| #6 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hello hello, habe die dateien "gefixt". die datei C:\Windows\system32\fccDTNgD.dll wird auf meinem system nicht gefunden. was jetzt? |
|
12.07.2008, 19:19
| #7 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 sorry, ich nochmal (ja ! ich bin tatsächlich blond!!) habe die gefunden dateien bei malware ebenfalls gelöscht. |
|
12.07.2008, 19:27
| #8 | ||
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36Zitat:
 Die Datei wurde durch Malwarebytes beseitigtBitte erstelle ein neues HijackThis Logfile und poste es Hast du noch immer die beschriebenen Probleme?
__________________ Kein Support per PN Zitat:
|
|
12.07.2008, 19:33
| #9 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Halb so wild.... Die Meldungen, dass ein Virus auf dem Rechner ist kommen nicht mehr - die Ordner lassen sich wieder öffnen. Falls wieder alles o.k. ist, kannst Du mir sagen was der fiese Wurm wollte? Backdoor etc.? Habe recht sensible Daten auf dem Rechner. Habe mir von Acronis ein Sicherungsprogramm bestellt und eine externe Festplatte bestellt, damit ich immer schön mein Backups erstellen kann. Für die Zukunft folgende Frage: Welches Antivirus Programm soll ich auf dem Rechner lassen? Habe ja momentan Avast und den Antivir drauf und den AdAware. Kenn mich doch gar nicht aus.... Noch eine letzte Frage: wie kann ich mich für Deine Hilfe erkenntlich zeigen???? :aplaus: Hier die File: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:29:30, on 12.07.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16681) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\system32\taskeng.exe C:\Windows\System32\mobsync.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {94F65BB8-DDEC-4B1A-9809-8B9E3F2B440E} - C:\Windows\system32\fccDTNgD.dll (file missing) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\6\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TeamViewer 3 (TeamViewer) - TeamViewer GmbH - C:\Program Files\TeamViewer3\TeamViewer_Host.exe O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe -- End of file - 11609 bytes |
|
13.07.2008, 10:45
| #10 | |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Hi Also nen Backdoor hattest du nicht  Ansonsten hätte ich dir ein Neuaufsetzen raten müssen... Soweit zu sehen war, war glaube ich nur ein einziger aktiv Das mit der externen Festplatte ist ne gute Idee, aber du kannst froh sein das du keinen Backdoor hattest oder so sonst hättest deine Daten vlt. verloren... Zu den AntiViren Progis, Avira AntiVir ist ne gute Lösung Da es auch über eine sehr gute Heuristik verfügt und damit viele Probleme früh erkennen kann. Die Hauptsache ist, dass du dein Surfverhalten evtl. ändern solltest um nicht mehr solche Probleme zu kriegen Mach immer wieder mal nen Komplet Scan und hüte dich davor auf ominösen Seiten irgendwelche Sachen dowzuloadenDiesen Eintrag solltest du noch mit HijackThis fixen: O2 - BHO: (no name) - {94F65BB8-DDEC-4B1A-9809-8B9E3F2B440E} - C:\Windows\system32\fccDTNgD.dll (file missing) Ein dankeschön reicht völlig aus  Noch ein schönes Wochenende 
__________________ Kein Support per PN Zitat:
|
|
13.07.2008, 13:26
| #11 |
| | TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 Ich bedanke mich sehr herzlich bei Dir für Deine Bemühungen und Deine Hilfe. Viele, vielen Dank. Liebe Grüße & alles Gute |
|
| Themen zu TR/Crypt.XPack.Gen, TR/BHO.ewy & TR/Fakealert.TK.36 |
| ad aware, ad-aware, antivir, antivirus, auswerten, avast!, avira, bho, bonjour, browser, cc cleaner, computer, explorer funktioniert nicht, firefox, google, helper, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, konvertieren, logfile, malware, mozilla, mozilla firefox, pdf-datei, pop-up-blocker, programdata, quara, senden, server, software, solution, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tuneup.defrag, urlsearchhook, windows, windows defender, windows explorer funktioniert nicht, windows sidebar |
Linear-Darstellung
