| |
| |||||||
Log-Analyse und Auswertung: Gambling Toolbar Problem... LogfileWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.09.2005, 21:51
| #1 |
 |  Gambling Toolbar Problem... Logfile Logfile of HijackThis v1.99.1 Scan saved at 22:53:18, on 13.09.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Programme\FRITZ!DSL\IGDCTRL.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\Norton AntiVirus\navapsvc.exe C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe D:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\devldr32.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\Java\jre1.5.0_04\bin\jusched.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\FRITZ!DSL\StCenter.exe C:\Programme\FRITZ!DSL\FwebProt.exe C:\Programme\iPod\bin\iPodService.exe C:\WINDOWS\System32\wuauclt.exe C:\Programme\Winamp\winamp.exe C:\Programme\Mozilla Firefox\firefox.exe D:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [u*l]h**p://www.web.de/[/url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R3 - URLSearchHook: (no name) - {61360BEC-C057-7B62-F30F-15F5FA8F33BC} - Preliminary.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {7F03D1BC-7821-4206-A170-727E241DB778} - C:\WINDOWS\System32\fbnfo.dll (file missing) O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [DTOURS] 321102.exe O4 - HKLM\..\Run: [FLKPT] new32.exe O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SetupExeDll] Brong32.exe O4 - HKCU\..\Run: [runload32] bnui.exe O4 - HKCU\..\Run: [SysEntry] xwiz.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - [u*l]h**p://arcade.icq.com/carlo/zuma/popcaploader_v5.cab[/url] O17 - HKLM\System\CCS\Services\Tcpip\..\{88408F87-7FCD-455B-B4AC-27975B7EBD70}: NameServer = 69.50.168.180,85.255.112.26 O18 - Filter: text/html - {0B90226A-5E78-4A1F-ABCC-8FB75BD33A4E} - C:\WINDOWS\System32\fbnfo.dll O18 - Filter: text/plain - {0B90226A-5E78-4A1F-ABCC-8FB75BD33A4E} - C:\WINDOWS\System32\fbnfo.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe |
|
13.09.2005, 23:30
| #2 |
  | Gambling Toolbar Problem... Logfile @th0m4d
__________________führe erst das hier aus http://www.trojaner-info.de/anleitun...out_blank.html update danach system und IE poste danach ein neues HJT logfile chaosman
__________________ |
|
14.09.2005, 14:05
| #3 |
| | Gambling Toolbar Problem... Logfile Logfile of HijackThis v1.99.1
__________________Scan saved at 15:06:39, on 14.09.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Programme\FRITZ!DSL\IGDCTRL.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\Norton AntiVirus\navapsvc.exe C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32\nvsvc32.exe D:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\devldr32.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\QuickTime\qttask.exe C:\Programme\Java\jre1.5.0_04\bin\jusched.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\Skype\Phone\Skype.exe C:\Programme\FRITZ!DSL\StCenter.exe C:\Programme\FRITZ!DSL\FwebProt.exe C:\Programme\iPod\bin\iPodService.exe D:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [u*l]h**p://www.web.de/[/url] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - URLSearchHook: (no name) - {61360BEC-C057-7B62-F30F-15F5FA8F33BC} - Preliminary.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [DTOURS] 321102.exe O4 - HKLM\..\Run: [FLKPT] new32.exe O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SetupExeDll] Brong32.exe O4 - HKCU\..\Run: [runload32] bnui.exe O4 - HKCU\..\Run: [SysEntry] xwiz.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - [u*l]h**p://arcade.icq.com/carlo/zuma/popcaploader_v5.cab[/url] O17 - HKLM\System\CCS\Services\Tcpip\..\{88408F87-7FCD-455B-B4AC-27975B7EBD70}: NameServer = 69.50.168.180,85.255.112.26 O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe |
|
14.09.2005, 14:06
| #4 |
| | Gambling Toolbar Problem... Logfile Oder dieses Log ? (14.9.05 15:00:18) SPSeHjFix started v1.1.2 (14.9.05 15:00:18) OS: WinXP Service Pack 1 (5.1.2600) (14.9.05 15:00:18) Language: deutsch (14.9.05 15:00:18) Win-Path: C:\WINDOWS (14.9.05 15:00:18) System-Path: C:\WINDOWS\System32 (14.9.05 15:00:18) Temp-Path: C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\ (14.9.05 15:00:21) Disinfection started (14.9.05 15:00:21) Bad-Dll(IEP): (not found) (14.9.05 15:00:21) Bad-Dll(IEP) in BHO: (not found) (14.9.05 15:00:21) Searchassistant Uninstaller found: regsvr32 /s /u C:\WINDOWS\System32\fbnfo.dll (14.9.05 15:00:21) Searchassistant Uninstaller - Keys Deleted (14.9.05 15:00:21) UBF: 6 - UBB: 5 - UBR: 14 (14.9.05 15:00:21) FilterKey: HKCR\text/html (deleted) (14.9.05 15:00:21) FilterKey: HKCR\CLSID\{0B90226A-5E78-4A1F-ABCC-8FB75BD33A4E} (deleted) (14.9.05 15:00:21) FilterKey: HKLM\SOFTWARE\Classes\text/html (error while deleting) (14.9.05 15:00:21) FilterKey: HKCR\text/plain (deleted) (14.9.05 15:00:21) FilterKey: HKCR\CLSID\{0B90226A-5E78-4A1F-ABCC-8FB75BD33A4E} (error while deleting) (14.9.05 15:00:21) FilterKey: HKLM\SOFTWARE\Classes\text/plain (error while deleting) (14.9.05 15:00:21) BHO-Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7F03D1BC-7821-4206-A170-727E241DB778} (deleted) (14.9.05 15:00:21) BHO-Key: HKCR\CLSID\{7F03D1BC-7821-4206-A170-727E241DB778} (deleted) (14.9.05 15:00:21) UBF: 4 - UBB: 4 - UBR: 14 (14.9.05 15:00:21) Bad IE-pages: deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, HomeOldSP: about:blank (14.9.05 15:00:21) Stealth-String not found (14.9.05 15:00:21) File added to delete: c:\windows\system32\fbnfo.dll (14.9.05 15:00:21) Reboot (14.9.05 15:06:04) SPSeHjFix started v1.1.2 (14.9.05 15:06:04) OS: WinXP Service Pack 1 (5.1.2600) (14.9.05 15:06:04) Language: deutsch (14.9.05 15:06:04) Win-Path: C:\WINDOWS (14.9.05 15:06:04) System-Path: C:\WINDOWS\System32 (14.9.05 15:06:04) Temp-Path: C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\ |
|
15.09.2005, 19:46
| #5 |
| | Gambling Toolbar Problem... Logfile was soll ich jetzt weiter machen??? |
|
15.09.2005, 19:56
| #6 |
| Gesperrt | Gambling Toolbar Problem... Logfile /edit Müll entsorgt. Cobra /edit Geändert von Cobra (15.09.2005 um 20:15 Uhr) |
|
15.09.2005, 20:33
| #7 |
 | Gambling Toolbar Problem... Logfile Halloth0m4d Wieso ist dein System nich upgedatet. Hast du schon mal was von SP2 gehört. Du solltest unbedingt Windows auf den neusten Stand bringen!! Lade Dir Spybot-S&D und Ad-Aware und update beide Programme. Lade Dir http://cwshredder.net/bin/CWShredder.exe und mache einen Doppelklick darauf. Nun findest Du auf deinem Desktop ein neues CWSshredder icon. Lade AboutBuster5 http://www.malwarebytes.biz/ Dann startest Du CWS Shredder. Lass das Tool alles machen was es will. Dann startest Du about:buster und lässt es laufen. Dann startest Du Adaware (perform full system scan anhaken) danach Spybot. Lösche alle Funde Mach einen Neustart. Downloade http://lineofire.geekstogo.com/cwsserviceremove.zip !! entpacke es und füge es per Doppelklick in Deine Registry ein. Bestätige die Sicherheitsabfrage mit Ja. Folgende Dateien können durch den HIjacker ersetzt/gelöscht sein. Einfach schauen ob sie da sind (CWS Shredder entfernt sie wenn befallen) * control.exe * rundll32.exe * wmplayer.exe * msconfig.exe * notepad.exe * shell.dll falls die Dateien nicht sichtbar sind, folgende Einstellung vornehmen. Versteckte Dateien sichtbar machen --> boote in den abgesicherter Modus , deaktiviere die Systemwiederherstellung , und fixe dann mit Hijack This (Häk'chen setzen und auf Fix Checked klicken ) Anleitung folgende Einträge falls noch vorhanden: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOKUME~1\trh0m4d\LOKALE~1\Temp\sp.html R3 - URLSearchHook: (no name) - {61360BEC-C057-7B62-F30F-15F5FA8F33BC} - Preliminary.dll (file missing) O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - (no file) O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\nijas.dll O4 - HKLM\..\Run: [DTOURS] 321102.exe O4 - HKLM\..\Run: [FLKPT] new32.exe O4 - HKCU\..\Run: [SetupExeDll] Brong32.exe O4 - HKCU\..\Run: [runload32] bnui.exe O4 - HKCU\..\Run: [SysEntry] xwiz.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyPoker.net\partypokernet.exe (file missing) O17 - HKLM\System\CCS\Services\Tcpip\..\{88408F87-7FCD-455B-B4AC-27975B7EBD70}: NameServer = 69.50.168.180,85.255.112.26 lösche von Hand falls noch vorhanden: C:\DOKUME~1\trh0m4d\LOKALE~1\Temp >> kompletten Ordner leeren C:\WINDOWS\System32\nijas.dll 321102.exe new32.exe Brong32.exe bnui.exe xwiz.exe scanne jetzt nacheinander mit Ad-aware und Spybot und lösche alle Funde. Neu booten und neues HJT posten BTW: du solltest dich für einenVirenscanner entscheiden zwei bremsen dein System unnötig aus. |
|
| Themen zu Gambling Toolbar Problem... Logfile |
| adobe, antivirus, bho, computer, dsl, excel, explorer, firefox, hijack, hijackthis, internet, internet explorer, logfile, microsoft, mozilla, mozilla firefox, nvidia, object, programme, rundll, software, symantec, system, temp, unknown file in winsock lsp, urlsearchhook, windows, windows xp |
Linear-Darstellung
