| |
| |||||||
Log-Analyse und Auswertung: Googlewarnung und seltsame EreigniseWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
05.05.2007, 11:00
| #8 |
 |  Googlewarnung und seltsame Ereignise Hab euch mal ne Logfile mit AdAware Se erstellt soll ja ähnlich sein wie das mir empfohlene tool vom russischen Programmierer. Also ich bin zwar kein programmierer o.ä. allerdings sieht das doch recht ordentlich aus oder??? Vielen Dank für die Mühen Ad-Aware SE Settings =========================== Set : Search for negligible risk entries Set : Safe mode (always request confirmation) Set : Scan active processes Set : Scan registry Set : Deep-scan registry Set : Scan my IE Favorites for banned URLs Set : Scan my Hosts file Extended Ad-Aware SE Settings =========================== Set : Unload recognized processes & modules during scan Set : Scan registry for all users instead of current user only Set : Always try to unload modules before deletion Set : During removal, unload Explorer and IE if necessary Set : Let Windows remove files in use at next reboot Set : Delete quarantined objects after restoring Set : Include basic Ad-Aware settings in log file Set : Include additional Ad-Aware settings in log file Set : Include reference summary in log file Set : Include alternate data stream details in log file Set : Play sound at scan completion if scan locates critical objects 05.05.2007 11:49:48 - Scan started. (Full System Scan) MRU List Object Recognized! Location: : C:\Dokumente und Einstellungen\Schneefusen\recent Description : list of recently opened documents MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct3d MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\direct3d\mostrecentapplication Description : most recent application to use microsoft direct X MRU List Object Recognized! Location: : software\microsoft\directdraw\mostrecentapplication Description : most recent application to use microsoft directdraw MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\directinput\mostrecentapplication Description : most recent application to use microsoft directinput MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\internet explorer\typedurls Description : list of recently entered addresses in microsoft internet explorer MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\medialibraryui Description : last selected node in the microsoft windows media player media library MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\player\recentfilelist Description : list of recently used files in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\player\settings Description : last open directory used in jasc paint shop pro MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\preferences Description : last playlist index loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\preferences Description : last playlist loaded in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\mediaplayer\preferences Description : last search path used in microsoft windows media player MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\microsoft management console\recent file list Description : list of recent snap-ins used in the microsoft management console MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\search assistant\acmru Description : list of recent search terms used with the search assistant MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru Description : list of recent programs opened MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru Description : list of recently saved files, stored according to file extension MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\windows\currentversion\explorer\recentdocs Description : list of recent documents opened MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\windows\currentversion\explorer\runmru Description : mru list for items opened in start | run MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\nvidia corporation\global\nview\windowmanagement Description : nvidia nview cached application window positions MRU List Object Recognized! Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\microsoft\windows media\wmsdk\general Description : windows media sdk MRU List Object Recognized! Location: : S-1-5-21-1482476501-261478967-1801674531-1004\software\winrar\dialogedithistory\extrpath Description : winrar "extract-to" history Listing running processes »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» #:1 [smss.exe] FilePath : \SystemRoot\System32\ ProcessID : 1096 ThreadCreationTime : 05.05.2007 08:48:24 BasePriority : Normal #:2 [csrss.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 1164 ThreadCreationTime : 05.05.2007 08:48:28 BasePriority : Normal #:3 [winlogon.exe] FilePath : \??\C:\WINDOWS\system32\ ProcessID : 1188 ThreadCreationTime : 05.05.2007 08:48:31 BasePriority : High #:4 [services.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1232 ThreadCreationTime : 05.05.2007 08:48:33 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Betriebssystem Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Anwendung für Dienste und Controller InternalName : services.exe LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten. OriginalFilename : services.exe #:5 [lsass.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1244 ThreadCreationTime : 05.05.2007 08:48:33 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : LSA Shell (Export Version) InternalName : lsass.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : lsass.exe #:6 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1388 ThreadCreationTime : 05.05.2007 08:48:35 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:7 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1468 ThreadCreationTime : 05.05.2007 08:48:35 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:8 [svchost.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 1508 ThreadCreationTime : 05.05.2007 08:48:36 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:9 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1580 ThreadCreationTime : 05.05.2007 08:48:36 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:10 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1616 ThreadCreationTime : 05.05.2007 08:48:36 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:11 [vsmon.exe] FilePath : C:\WINDOWS\system32\ZONELABS\ ProcessID : 1628 ThreadCreationTime : 05.05.2007 08:48:36 BasePriority : Normal FileVersion : 7.0.337.000 ProductVersion : 7.0.337.000 ProductName : TrueVector Service CompanyName : Zone Labs, LLC FileDescription : TrueVector Service InternalName : vsmon LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : vsmon.exe #:12 [explorer.exe] FilePath : C:\WINDOWS\ ProcessID : 1852 ThreadCreationTime : 05.05.2007 08:48:43 BasePriority : Normal FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 6.00.2900.2180 ProductName : Betriebssystem Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Windows Explorer InternalName : explorer LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten. OriginalFilename : EXPLORER.EXE #:13 [scanningprocess.exe] FilePath : C:\WINDOWS\system32\ZONELABS\avsys\ ProcessID : 2040 ThreadCreationTime : 05.05.2007 08:48:49 BasePriority : Normal #:14 [spoolsv.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 416 ThreadCreationTime : 05.05.2007 08:48:52 BasePriority : Normal FileVersion : 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519) ProductVersion : 5.1.2600.2696 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Spooler SubSystem App InternalName : spoolsv.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : spoolsv.exe #:15 [scanningprocess.exe] FilePath : C:\WINDOWS\system32\ZONELABS\avsys\ ProcessID : 508 ThreadCreationTime : 05.05.2007 08:48:54 BasePriority : Normal #:16 [monitor.exe] FilePath : C:\WINDOWS\system32\ZONELABS\avsys\ ProcessID : 524 ThreadCreationTime : 05.05.2007 08:48:55 BasePriority : Normal #:17 [schedul2.exe] FilePath : C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\ ProcessID : 868 ThreadCreationTime : 05.05.2007 08:49:08 BasePriority : Normal FileVersion : 1,0,0,240 ProductVersion : 1,0,0,240 ProductName : Acronis Scheduler 2 CompanyName : Acronis FileDescription : Acronis Scheduler 2 InternalName : Scheduler2 LegalCopyright : Copyright (C) 2000-2004 Acronis LegalTrademarks : Acronis OriginalFilename : schedul2.exe Comments : Acronis Scheduler 2 #:18 [acs.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 912 ThreadCreationTime : 05.05.2007 08:49:08 BasePriority : Normal #:19 [nvsvc32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1372 ThreadCreationTime : 05.05.2007 08:49:09 BasePriority : Normal FileVersion : 6.14.10.9147 ProductVersion : 6.14.10.9147 ProductName : NVIDIA Driver Helper Service, Version 91.47 CompanyName : NVIDIA Corporation FileDescription : NVIDIA Driver Helper Service, Version 91.47 InternalName : NVSVC LegalCopyright : (C) NVIDIA Corporation. All rights reserved. OriginalFilename : nvsvc32.exe #:20 [svchost.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 1568 ThreadCreationTime : 05.05.2007 08:49:09 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Generic Host Process for Win32 Services InternalName : svchost.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : svchost.exe #:21 [svpnstarter.exe] FilePath : D:\Programme\Steganos Internet Anonym VPN\ ProcessID : 1656 ThreadCreationTime : 05.05.2007 08:49:10 BasePriority : Normal FileVersion : 1.1.3 ProductVersion : 1.1.3 ProductName : Steganos Internet Anonym VPN OriginalFilename : SVPNStarter.exe #:22 [alg.exe] FilePath : C:\WINDOWS\System32\ ProcessID : 3468 ThreadCreationTime : 05.05.2007 08:49:27 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : Application Layer Gateway Service InternalName : ALG.exe LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : ALG.exe #:23 [zlclient.exe] FilePath : D:\Programme\ZoneAlarm\ ProcessID : 2440 ThreadCreationTime : 05.05.2007 08:49:34 BasePriority : Normal FileVersion : 7.0.337.000 ProductVersion : 7.0.337.000 ProductName : ZoneAlarm Client CompanyName : Zone Labs, LLC FileDescription : ZoneAlarm Client InternalName : zlclient LegalCopyright : Copyright © 1998-2006, Zone Labs, LLC OriginalFilename : zlclient.exe #:24 [rundll32.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2500 ThreadCreationTime : 05.05.2007 08:49:35 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Betriebssystem Microsoft® Windows® CompanyName : Microsoft Corporation FileDescription : Eine DLL-Datei als Anwendung ausführen InternalName : rundll LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten. OriginalFilename : RUNDLL.EXE #:25 [ctfmon.exe] FilePath : C:\WINDOWS\system32\ ProcessID : 2876 ThreadCreationTime : 05.05.2007 08:49:37 BasePriority : Normal FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) ProductVersion : 5.1.2600.2180 ProductName : Microsoft® Windows® Operating System CompanyName : Microsoft Corporation FileDescription : CTF Loader InternalName : CTFMON LegalCopyright : © Microsoft Corporation. All rights reserved. OriginalFilename : CTFMON.EXE #:26 [usr54g.exe] FilePath : D:\Programme\WLAN Manager\ ProcessID : 3316 ThreadCreationTime : 05.05.2007 08:49:37 BasePriority : Normal FileVersion : 2.3.0.3 ProductVersion : 2.3.0.3 FileDescription : WLAN configuration utility InternalName : Monitor LegalCopyright : Copyright (C) 2005 OriginalFilename : Monitor.exe #:27 [mantispm.exe] FilePath : D:\PROGRA~1\ZONEAL~1\MAILFR~1\ ProcessID : 2388 ThreadCreationTime : 05.05.2007 08:49:45 BasePriority : Normal FileVersion : 4, 9, 1, 8211 ProductVersion : 4, 9, 1, 8211 FileDescription : Spam Filter InternalName : mantispm.exe LegalCopyright : (c) 2002-2004 OriginalFilename : mantispm.exe #:28 [firefox.exe] FilePath : D:\Programme\Mozilla Firefox\ ProcessID : 2464 ThreadCreationTime : 05.05.2007 09:31:10 BasePriority : Normal #:29 [ad-aware.exe] FilePath : D:\Programme\Lavasoft\Ad-Aware SE Personal\ ProcessID : 2248 ThreadCreationTime : 05.05.2007 09:49:16 BasePriority : Normal FileVersion : 6.2.0.236 ProductVersion : SE 106 ProductName : Lavasoft Ad-Aware SE CompanyName : Lavasoft Sweden FileDescription : Ad-Aware SE Core application InternalName : Ad-Aware.exe LegalCopyright : Copyright © Lavasoft AB Sweden OriginalFilename : Ad-Aware.exe Comments : All Rights Reserved |
| Themen zu Googlewarnung und seltsame Ereignise |
| adobe, bho, dateien, desktop, disk director, dll, einstellungen, explorer, frage, google, hijack, home, internet, internet explorer, microsoft, monitor, neustart, nvidia, pdf, programme, rundll, software, system, windows, windows xp, wlan |
Baum-Darstellung