Brauch Hilfe zu Google Redirect Virus

hanksh · 11.07.2009, 21:01

Hallo,

Google leitet auf falsche Seiten weiter. Hab' mich im Forum

schlau gemacht und die empfohlenen Schritte durchgeführt:
1. CCleaner (sieht sauber aus)
2. Malwarebaytes-Anti-Malware (infizierte Datein gefunden, s.u.; anschließend behoben)
3. HijackThis. Hier die Log-Files (s.u.)
4. Liste der installierten Programme (s.u.)

Wäre super, wenn mich jemand unterstützen könnte, den lästigen Virus loszuwerden.

Dank für Eure Mühe im Voraus.

Malwarebytes' Anti-Malware 1.38
Datenbank Version: 2297
Windows 6.0.6001 Service Pack 1

06.07.2009 06:17:25
mbam-log-2009-07-06 (06-17-15).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|G:\|H:\|)
Durchsuchte Objekte: 404353
Laufzeit: 2 hour(s), 9 minute(s), 14 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 21

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Hans\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\7HP09I75\installer_70141[1].exe (Rogue.Installer) -> No action taken.
c:\Users\Admin\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Bigo\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Gast\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Hans\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Lotte\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Paul\AppData\Roaming\microsoft\internet explorer\quick launch\Antivirus Plus(3).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Public\Desktop\Antivirus Plus(1).lnk (Rogue.AntiVirusPlus) -> No action taken.
c:\Users\Public\Desktop\Antivirus Plus(2).lnk (Rogue.AntiVirusPlus) -> No action taken.
C:\Windows\System32\dmns.cfg (Rogue.AntiVirusPro) -> No action taken.
C:\Windows\System32\avp.id (Rogue.AntiVirusPro) -> No action taken.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:33, on 11.07.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.BIN
C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 89.149.210.104 w*w.google.com
O1 - Hosts: 89.149.210.104 w*w.google.de
O1 - Hosts: 89.149.210.104 w*w.google.fr
O1 - Hosts: 89.149.210.104 w*w.google.co.uk
O1 - Hosts: 89.149.210.104 w*w.google.com.br
O1 - Hosts: 89.149.210.104 w*w.google.it
O1 - Hosts: 89.149.210.104 w*w.google.es
O1 - Hosts: 89.149.210.104 w*w.google.co.jp
O1 - Hosts: 89.149.210.104 w*w.google.com.mx
O1 - Hosts: 89.149.210.104 w*w.google.ca
O1 - Hosts: 89.149.210.104 w*w.google.com.au
O1 - Hosts: 89.149.210.104 w*w.google.nl
O1 - Hosts: 89.149.210.104 w*w.google.co.za
O1 - Hosts: 89.149.210.104 w*w.google.be
O1 - Hosts: 89.149.210.104 w*w.google.gr
O1 - Hosts: 89.149.210.104 w*w.google.at
O1 - Hosts: 89.149.210.104 w*w.google.se
O1 - Hosts: 89.149.210.104 w*w.google.ch
O1 - Hosts: 89.149.210.104 w*w.google.pt
O1 - Hosts: 89.149.210.104 w*w.google.dk
O1 - Hosts: 89.149.210.104 w*w.google.fi
O1 - Hosts: 89.149.210.104 w*w.google.ie
O1 - Hosts: 89.149.210.104 w*w.google.no
O1 - Hosts: 89.149.210.104 search.yahoo.com
O1 - Hosts: 89.149.210.104 us.search.yahoo.com
O1 - Hosts: 89.149.210.104 uk.search.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Users\xxxx\Downloads\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [1&1 SMS-Manager] C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [Free Download Manager] D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe (User 'xxxx')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1003\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx')
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - S-1-5-21-730465023-3478590947-2926549422-1003 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - S-1-5-21-730465023-3478590947-2926549422-1003 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe
O4 - Global Startup: FRITZ!DSL Startcenter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dllink.htm
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html
O8 - Extra context menu item: Videos mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlfvideo.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - h**p://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - h**ps://juniper.net/dana-cached/sc/JuniperSetupClient.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files (x86)\Common Files\AVM\de_serv.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 14131 bytes

Installierte Software:

1&1 SMS-Manager
1&1 SoftPhone
abitEQ V1.1.1.2
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1 - Deutsch
Anno 1701
Apple Software Update
Aufstieg des Hexenkönigs™
AVM FRITZ!DSL
AVM FRITZ!fax für FRITZ!Box
Canon G.726 WMP-Decoder
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon OpenPage Print Component
Canon PowerShot RS-232C TWAIN Driver
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture DC
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Carnet d'activités À plus! 1
CCleaner (remove only)
Creative MediaSource 5
Die Schlacht um Mittelerde™ II
FlashMenu
flatster
FRITZ!Box
Fujicolor Bestell-Software
GameShadow
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
Green Line NEW 2 Bayern Sprachtrainer Kommunikation
HALO 2 FÜR WINDOWS VISTA
Hauppauge German Help Files and Resources
Hauppauge WinTV
Hauppauge WinTV Infrared Remote
Hauppauge WinTV Scheduler
Hauppauge WinTV Soft PVR
HijackThis 2.0.2
Interaktiver Adventskalender
InterVideo FilterSDK for Hauppauge
Java(TM) 6 Update 13
Juniper Networks Setup Client Activex Control
LIVE gaming on Windows Runtime Version 1.0.6027
LiveUpdate Notice (Symantec Corporation)
Logitech Desktop Messenger
Logitech SetPoint
Malwarebytes' Anti-Malware
Microsoft Halo Trial

kira · 12.07.2009, 17:28

Hallo hanksh

- Die Anweisungen bitte gründlich lesen und immer streng einhalten, da ich die Reihenfolge nach bestimmten Kriterien vorbereitet habe:
1.
den Quarantäne Ordner überall leeren - Antivirus bzw Anti-Spy-Programm usw
das Malwarebytes deinstallieren

2.
Lade dir HostsXpert auf dem Desktop speichern & und entpacken

Ordner HostsXpert öffnen.
HostsXpert.exe doppelklicken.
klicke auf Restore Microsoft's Hosts File,dann OK.

3.

lade Dir SUPERAntiSpyware FREE Edition herunter.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

am besten nutze den Code-Tags für deinen Post:
vor dein log schreibst du:[code]
hier kommt dein logfile rein
dahinter:[/code]

gruß
Coverflow

hanksh · 12.07.2009, 21:23

Hallo Coverflow,

hab mich an die Anweisung gehalten. Hier das Ergebnis (Teil 1).

Gruß
hanksh

Code:

ATTFilter

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/12/2009 at 09:49 PM

Application Version : 4.26.1006

Core Rules Database Version : 3988
Trace Rules Database Version: 1928

Scan type       : Complete Scan
Total Scan Time : 01:24:14

Memory items scanned      : 701
Memory threats detected   : 0
Registry items scanned    : 6151
Registry threats detected : 0
File items scanned        : 53753
File threats detected     : 375

Adware.Tracking Cookie
	C:\Users\Admin\AppData\Local\Temp\Low\Cookies\admin@doubleclick[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@serving-sys[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@adfarm1.adition[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@doubleclick[2].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@doubleclick[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bs.serving-sys[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bs.serving-sys[3].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@atdmt[2].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@serving-sys[2].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msnportal.112.2o7[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msnportal.112.2o7[2].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@atdmt[1].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@adfarm1.adition[2].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@atdmt[1].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv1.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wckiqpcpalo.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6whkiugazklp.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[5].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.matratzendiscount[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[6].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@alpha.adwaves[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[7].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.adserverhome[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[4].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tribalfusion[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.cnn[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.jugendherberge[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@arcor.122.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ehg-tiscover.hitbox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@roitracking[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bridge1.admarketplace[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.adtechus[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.mlsat02[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.pointroll[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.71i[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.ganz-muenchen[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.adform[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webcount.feratel[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@meetupcom.122.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@allesklarcomag.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.tier[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tacoda[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bluestreak[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statse.webtrendslive[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracknet.twyn[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.easyad[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.proxad[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@web4.realtracker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hitbox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@admarketplace[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@rotator.adjuggler[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stat.dealtime[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas4.emediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@valueclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media.adrevolver[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@club.zanox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ottotrialpopunders.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@fastclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.evendi[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statcounter[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ottogroup.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adopt.euroclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@indextools[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@data.coremetrics[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.testberichte[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@at.atwola[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserv.chirurgie-portal[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@m1.webstats.motigo[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.performance-adserver[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.adnet[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.1a-infosysteme[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.partnerbridge[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adrevolver[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a7.adserver01[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@overture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.verlag.henrich[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.bauerverlag[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediaflite[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@208.122.40[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.boreus[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adviva[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@flightstats[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hbxtracking.sueddeutsche[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@loyaltypartner.122.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@xiti[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[1].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@atdmt[2].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@im.banner.t-online[1].txt
	C:\Users\xxxx\AppData\Local\Temp\Low\Cookies\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediaflite[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ad-srv[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.teleint[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[4].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.dbxtrackers[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@content.yieldmanager[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euroclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv1.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.matratzendiscount[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.adserverhome[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.paypal[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.jugendherberge[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6whmiendzcgq.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wfk4sgajedp.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media-center.1und1[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tunefinder[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wfmyemcjmhq.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.radsport-aktiv[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@count.primawebtools[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.adform[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wbl4shd5wcp.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@overture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dbxtrackers[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dbxtrackers[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ambiweb[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad1.emediate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media6degrees[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.testberichte[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftinternetexplorer.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a2.adserver01[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.boreus[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@e-2dj6wgkicocjsko.stats.esomniture[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.salebroker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@valueclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.klicktel[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.oneview[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@siemens.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.1a-infosysteme[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.dialogmediencenter[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stat.vattenfall[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a6.adserver01[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.partnerbridge[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.11880[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.traffictrack[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@vodafonegroup.122.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a7.adserver01[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ww3.shoshkeles[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.alpenverein[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@208.122.40[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@4stats[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@content.yieldmanager.edgesuite[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@cpx.mediascale[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@delivery.ads.coupling-media[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@hbxtracking.sueddeutsche[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@unitymedia[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[1].txt

hanksh · 12.07.2009, 21:25

... und Teil 2

Code:

ATTFilter

C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising.youdagames[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.net-games[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@at.atwola[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.ehapa[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.71i[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@stats.ehapa[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@gjacket.adbureau[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tacoda[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftwindows.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@m1.webstats.motigo[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@dmtracker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.easyad[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apm.emediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@casalemedia[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@statse.webtrendslive[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tribalfusion[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bluestreak[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.adnet[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@server.cpmstar[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@rotator.adjuggler[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.gamershell[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.71i[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads2.uclick[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.cdpoker[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@files.youporn[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.web-mediaplayer[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@trackmatics[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@pornhub[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@server.cpmstar[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.etracker[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@fastclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads-dev.youporn[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adstar-media[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.gamesbannernet[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@de2.komtrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.yieldmanager[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.eurogrand[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.glispa[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[4].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.scribefire[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.googleadservices[3].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@web-mediaplayer[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.zanox-affiliate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads2.net2day[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.quisma[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zbox.zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@microsoftmachinetranslation.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@banner.skykingscasino[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eas.apm.emediate[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.loudsocial[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads3.net2day[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.active-tracking[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.sun[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@euros4click[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@keygenguru[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads4.net2day[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@collective-media[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.mediamayhemcorp[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.nordprovider[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.net2day[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@www.pro-advertise[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@imrworldwide[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.adshopping[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@counter.live4members[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.ad4game[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a3.adserver01[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@a2.adserver01[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.salebroker[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertiser1.contextmatters[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.trackbar[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.ambiweb[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@date.ventivmedia[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@eaeacom.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@im.banner.t-online[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@komtrack[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@media6degrees[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@track.webtrekk[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracking.3gnet[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tracknet.twyn[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@usenext.softonic[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\xxxx@windowsmedia[1].txt

kira · 13.07.2009, 00:17

hi

poste bitte erneut ein neu erstellte HijackThis-Logfile

hanksh · 13.07.2009, 22:23

Hallo Coverflow,

hier das neu erstellte HiJack-Logfile.

Gruß
hanksh

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:11:26, on 13.07.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\WinTV\Ir.exe
C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.BIN
c:\program files (x86)\common files\installshield\updateservice\isuspm.exe
C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe
C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\agent.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135

\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642

\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google 

Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Users\xxxx\Downloads\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" 

/a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [1&1 SMS-Manager] C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [Free Download Manager] D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe
O4 - Global Startup: FRITZ!DSL Startcenter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dllink.htm
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html
O8 - Extra context menu item: Videos mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlfvideo.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - 

http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-

8876480.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files (x86)\Common Files\AVM\de_serv.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe 

(file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-

2F227FCA9A08}\PIFSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media 

Player\wmpnetwk.exe (file missing)

--
End of file - 12446 bytes

kira · 14.07.2009, 18:02

hi

1.
Schliesse alle Programme einschliesslich Internet Explorer und fixe mit Hijackthis die Einträge aus der nachfolgenden Codebox (HijackThis starten--> Einträge auswählen--> Häckhen setzen--> "Fix checked"klicken-->PC neu aufstarten):

Zitat:

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - h**ps://juniper.net/dana-cached/sc/JuniperSetupClient.cab

2.
den Quarantine-Inhalt löschen danach update Malwarebytes Anti-Malware, lass es nochmal laufen, lösche alles, was gefunden wird,Log posten

3.
alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren
lösche nur den Inhalt der Ordner, nicht die Ordner selbst! - Dateien, die noch in Benutzung sind,nicht löschbar.
c:\windows\temp
- anschließend den Papierkorb leeren

4.
reinige dein System mit Ccleaner:

"Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

5.

lade Dir SUPERAntiSpyware FREE Edition herunter.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Den kompletten Rechner zu überprüfen (Systemprüfung ohne säuberung) mit Kaspersky Online - Scanner:
Internet Explorer-> Extras-> Internetoptionen-> Sicherheit:

alles auf Standardstufe stellen
Active X erlauben
Speichere und poste das Logfile des Scans - speichere die Ergebnis als .txt Datei

hanksh · 15.07.2009, 22:53

Hallo,

Google arbeitet wieder normal.

An dieser Stelle, danke für die professionelle und und vor allem prompte Unterstützung. :aplaus: Waren alles perfekte Anweisungen, das Ding wieder loszuwerden.

Hat etwas länger gedauert, die Scanns laufen zu lassen. Der Kaspersky Online Scanner kann ich nicht laufen lassen, da er nur auf einem 32Bit System läuft.

Eigenartig nur, dass der Rechner jetzt immer 10 Minuten zum hochfahren braucht! Gibt's dafür einen plausiblen Grund?

Gruß
hansksh

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.39
Datenbank Version: 2429
Windows 6.0.6001 Service Pack 1

15.07.2009 06:20:00
mbam-log-2009-07-15 (06-20-00).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|G:\|H:\|)
Durchsuchte Objekte: 412372
Laufzeit: 1 hour(s), 28 minute(s), 16 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



SUPERAntiSpyware Scan Log
http://wxw.superantispyware.com

Generated 07/15/2009 at 11:41 PM

Application Version : 4.26.1006

Core Rules Database Version : 3988
Trace Rules Database Version: 1928

Scan type       : Complete Scan
Total Scan Time : 01:49:43

Memory items scanned      : 517
Memory threats detected   : 0
Registry items scanned    : 5917
Registry threats detected : 0
File items scanned        : 60506
File threats detected     : 36

Adware.Tracking Cookie
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@atdmt[2].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@doubleclick[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@kaspersky.122.2o7[1].txt
	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@msnportal.112.2o7[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ad.zanox[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adfarm1.adition[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads-dev.youporn[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.heias[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.planetactive[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@ads.quartermedia[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adserver.71i[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adsrv1.admediate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@adtech[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@advertising[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@apmebf[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@atdmt[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@bs.serving-sys[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@casalemedia[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@doubleclick[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@mediaplex[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@questionmarket[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@revenue[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@serving-sys[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tradedoubler[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@traffictrack[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@tto2.traffictrack[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@webmasterplan[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@wxw.etracker[2].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox-affiliate[1].txt
	C:\Users\xxxx\AppData\Roaming\Microsoft\Windows\Cookies\Low\xxxx@zanox[1].txt

kira · 16.07.2009, 20:08

hi

- Schritt 5. - SUPERAntiSpyware FREE Edition - vergessen?

- Malwarebytes' Anti-Malware kannst wieder deinstallieren

hanksh · 17.07.2009, 11:43

Hallo,

hatte Schritt 5 nicht vergessen; hab nur ein Code-Fester für beide Scanns Anti-Malware und SUPERAntiSpyware FREE Edition erstellt. Siehe mein Post vom 15.7.

Gruß
hanksh

kira · 17.07.2009, 18:02

OK

poste erneut:
Trend Micro HijackThis-Logfile - sollst bitte bei dem Editor den Zeilenumbruch rausnehmen, mit welchem sich das HJT/Trend Micro-Logfile öffnet.

hanksh · 18.07.2009, 09:17

Hallo Coverflow, hier das Log-file.

Gruß
hanksh

Code:

ATTFilter

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:19, on 18.07.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe
D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\WinTV\Ir.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files (x86)\FRITZ!DSL\StCenter.exe
C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Windows\Samsung\PanelMgr\SSMMgr.exe
C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 2.3\program\soffice.BIN
C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Users\xxxx\Downloads\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [1&1 SMS-Manager] C:\Program Files (x86)\1&1\SMS-Manager\SMSMngr.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [Free Download Manager] D:\Users\xxxx\Downloads\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe (User 'xxxx')
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Program Files (x86)\FRITZ!DSL\FwebProt.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe
O4 - Global Startup: FRITZ!DSL Startcenter.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dllink.htm
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\ProgramData\1&1\1&1 SoftPhone\ContextMenuHandler.html
O8 - Extra context menu item: Videos mit FDM herunterladen - file://D:\Users\xxxx\Downloads\Free Download Manager\dlfvideo.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\coIEPlg.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Program Files (x86)\Common Files\AVM\de_serv.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files (x86)\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\16.5.0.135\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12891 bytes

kira · 18.07.2009, 10:40

hi

Dein System schneller machen:
Programme im Autostart sind Programme, die sich (mit oder ohne Zustimmung des Users) im Autostart eingetragen haben und sofort mit Windows hochfahren. Je mehr Programme hier aufgeführt sind, umso langsamer startet Windows!
"Start→ ausführen→ "msconfig" (reinschreiben ohne ""→ OK" - it-academy.cc - pqtuning.de
Einfach dort den Haken herausnehmen, dann die Programme starten nicht mehr automatisch. Du kannst aber jeder zeit manuell starten - (nach deinen Bedürfnissen anpassen, es ist immer Benutzerspezifisch,ein allgemein gültiges Rezept gibt es nicht)
Wird noch nach dem nächsten Neustart wieder ein Hinweisfenster erscheinen, da ist ein Haken setzen : `Meldung nicht mehr anzeigen und dieses Programm beim Windows-Star nicht mehr starten`
- auf keinen Fall Grafiktreibers, Firewall und Anti-Viren-Programmen abschalten!!
Ausschaltkandidaten sind:

Code:

ATTFilter

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files (x86)\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'xxxx')
O4 - HKUS\S-1-5-21-730465023-3478590947-2926549422-1001\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe (User 'xxxx')
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - S-1-5-21-730465023-3478590947-2926549422-1001 User Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe (User 'xxxx')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files (x86)\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files (x86)\WinTV\Ir.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?

- Dienste kannst genauso nachprüfen : Start→ Alle Programme →Zubehör →Ausführen →"services.msc" (reinschreiben ohne "") →Ok

- Toolbars & BHO`s

hanksh · 19.07.2009, 09:59

Hallo,

habe einige Programme aus dem Autostart entfernt, so dass der Rechner nach Benutzeranmeldung nun schneller hoch läuft.

Allerdings benötigt Vista weiterhin ca. 5-6 Minuten, bis erstmals die Anmeldemaske erscheint. Dabei bleibt der Bildschirm in der Hälfte der Zeit völlig dunkel und zwar nachdem der Vista-Durchlaufbalken beendet ist. Diese Dunkelphase war früher nicht oder überhaupt nicht ausgeprägt. Der Rechner scheint auf einen Timeout zu warten. Was tun?

Gruß
hanksh

kira · 21.07.2009, 22:18

hi

versuche bitte folgendes:

- Start→ Alle Programme → Zubehör → Ausführen →"services.msc" (reinschreiben ohne "") →Ok
da die `Dienste` anwählen→ unten auf auf alle "Microsoft Dienste ausblenden" klicken→ dann alle Dienste abwählen und booten...

- Sollst alle Dienste, die nicht v. Microsoft stammen deaktivieren und neustarten. Wenn dein Rechner schneller ist, dann ist da ein Dienst der Probleme macht. Wenn nicht kannst die Dienste wieder anmachen

13.07.2009, 00:17	#5
kira /// Helfer-Team	Brauch Hilfe zu Google Redirect Virus hi poste bitte erneut ein neu erstellte HijackThis-Logfile

16.07.2009, 20:08	#9
kira /// Helfer-Team	Brauch Hilfe zu Google Redirect Virus hi - Schritt 5. - SUPERAntiSpyware FREE Edition - vergessen? - Malwarebytes' Anti-Malware kannst wieder deinstallieren

17.07.2009, 18:02	#11
kira /// Helfer-Team	Brauch Hilfe zu Google Redirect Virus OK poste erneut: Trend Micro HijackThis-Logfile - sollst bitte bei dem Editor den Zeilenumbruch rausnehmen, mit welchem sich das HJT/Trend Micro-Logfile öffnet.

Brauch Hilfe zu Google Redirect Virus

Log-Analyse und Auswertung: Brauch Hilfe zu Google Redirect Virus