| |
| |||||||
Log-Analyse und Auswertung: EigenlebenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
14.07.2007, 10:32
| #1 |
  |  Eigenleben Hallo sieht mir sehr nach Swizzor aus, ein Werbeeinblender. Mach bitte alle versteckten Dateien und Ordner sichtbar. Lade dir Silentrunners und lasse es dein System scannen und poste das Log, anschließend kopiere den folgenden Text : Code:
ATTFilter cd\
dir "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Anwendungsdaten" >>files.txt
dir "C:\Windows\tasks" >>files.txt
notepad files.txt
und gebe bei Dateityp "Alle Dateien" an, du solltest jetzt auf dem Desktop diese Datei finden --> Ordner.bat --> dann die Ordner.bat doppelt klicken (nur 1x) --> unter C:\files.txt findest du die Informationen die uns nun interessieren, kopiere den Text ab und poste ihn hierher. MFG |
|
14.07.2007, 11:31
| #2 | |
| | Eigenleben Hallo nochdigger,
__________________das log von Silentrunners produziert bei mir knapp 27000 Zeichen, allerdings darf man hier nur 25000 Zeichen posten. Idee ??Gruß Jens Zitat:
|
|
14.07.2007, 11:47
| #3 | ||
| | Eigenleben Hier Teil 2:
__________________Enabled Scheduled Tasks: ------------------------ "1-Klick-Wartung" -> launches: "C:\Programme\TuneUp Utilities 2007\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"] "Auf Updates für Windows Live Toolbar prüfen" -> launches: "C:\Programme\Windows Live Toolbar\MSNTBUP.EXE" [MS] "FRU Task #Hewlett-Packard#hp officejet 6100 series#1159894670" -> launches: "C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe -I "#Hewlett-Packard#hp officejet 6100 series#1159894670"" [empty string] "Norton AntiVirus - Vollständige Systemprüfung ausführen - Jo" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /TASK:"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"] "Norton SystemWorks One Button Checkup" -> launches: "C:\Programme\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE /AUTO" ["Symantec Corporation"] "Symantec Drmc" -> launches: "C:\Programme\Gemeinsame Dateien\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"] "User_Feed_Synchronization-{DCA16C5C-2FFC-4B7E-B57A-A6C0BFA19366}" -> launches: "C:\WINDOWS\system32\msfeedssync.exe sync" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 21 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{8C3887BA-3367-4297-B288-13472BD407E4}" -> {HKLM...CLSID} = "mateSuite - passMate" \InProcServer32\(Default) = "C:\Programme\REINER SCT\mateSuite\mspmie.dll" [empty string] "{C4069E3A-68F1-403E-B40E-20066696354B}" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "C:\Programme\Windows Live Toolbar\msntb.dll" [MS] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] HKLM\Software\Microsoft\Internet Explorer\Toolbar\ "{8C3887BA-3367-4297-B288-13472BD407E4}" = "PassMateToolbar" -> {HKLM...CLSID} = "mateSuite - passMate" \InProcServer32\(Default) = "C:\Programme\REINER SCT\mateSuite\mspmie.dll" [empty string] "{C4069E3A-68F1-403E-B40E-20066696354B}" = "Norton AntiVirus" -> {HKLM...CLSID} = "Norton AntiVirus" \InProcServer32\(Default) = "C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] "{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar" \InProcServer32\(Default) = "C:\Programme\Windows Live Toolbar\msntb.dll" [MS] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ {182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.5.0_11" \InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_11\bin\npjpi150_11.dll" ["Sun Microsystems, Inc."] {5E638779-1818-4754-A595-EF1C63B87A56}\ "ButtonText" = "Express Cleanup" "MenuText" = "Express Cleanup" "Exec" = "C:\Programme\Norton SystemWorks\Norton Cleanup\WCQuick.lnk" [null data] {E2E2DD38-D088-4134-82B7-F2BA38496583}\ "MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Miscellaneous IE Hijack Points ------------------------------ HKLM\Software\Microsoft\Internet Explorer\AboutURLs\ <<H>> "TuneUp" = "file://C|/Dokumente und Einstellungen/All Users/Anwendungsdaten/TuneUp Software/Common/base.css" [file not found] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Adobe LM Service, Adobe LM Service, ""C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe"" ["Adobe Systems"] Adobe Version Cue CS2, Adobe Version Cue CS2, ""C:\Programme\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service" ["Adobe Systems Incorporated"] Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] Automatisches LiveUpdate - Scheduler, Automatisches LiveUpdate - Scheduler, ""C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe"" ["Symantec Corporation"] GEARSecurity, GEARSecurity, "C:\WINDOWS\System32\GEARSec.exe" ["GEAR Software"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] LiveUpdate Notice Service, LiveUpdate Notice Service, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll"" ["Symantec Corporation"] mateSuite cryptMate Service, mscmsvr, "C:\Programme\REINER SCT\mateSuite\mscmsvr.exe" [empty string] mateSuite CT Monitoring Service, msctsvr, "C:\Programme\REINER SCT\mateSuite\msctsvr.exe" ["REINER SCT, SII"] mateSuite passMate Service, mspmsvr, "C:\Programme\REINER SCT\mateSuite\mspmsvr.exe" ["REINER SCT, SII "] mateSuiteCardService, mateSuiteCardService, "C:\Programme\REINER SCT\mateSuite\mscs.exe" [empty string] Media Center Extender Service, McrdSvc, "C:\WINDOWS\ehome\mcrdsvc.exe" [MS] Media Center Receiver Service, ehRecvr, "C:\WINDOWS\eHome\ehRecvr.exe" [MS] Media Center-Planerdienst, ehSched, "C:\WINDOWS\eHome\ehSched.exe" [MS] Norton AntiVirus Auto-Protect-Dienst, navapsvc, ""C:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"] Norton AntiVirus Firewall Monitor Service, NPFMntor, ""C:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe"" ["Symantec Corporation"] Norton Ghost, Norton Ghost, "C:\Programme\Symantec\Norton Ghost\Agent\PQV2iSvc.exe" ["Symantec Corporation"] Norton Protection Center Service, NSCService, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Console\NSCSRVCE.EXE"" ["Symantec Corporation"] Norton UnErase Protection, NProtectService, "C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"] O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"] SPBBCSvc, SPBBCSvc, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe"" ["Symantec Corporation"] Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"] Symantec Core LC, Symantec Core LC, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe"" ["Symantec Corporation"] Symantec Event Manager, ccEvtMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"] Symantec Network Drivers Service, SNDSrvc, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe"" ["Symantec Corporation"] Symantec Settings Manager, ccSetMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"] TuneUp Designerweiterung, UxTuneUp, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"]} Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ Adobe PDF Port\Driver = "C:\WINDOWS\system32\AdobePDF.dll" ["Adobe Systems Incorporated."] hpzlnt07\Driver = "hpzlnt07.dll" ["HP"] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 82 seconds, including 2 seconds for message boxes) Zitat:
Zitat:
|
|
14.07.2007, 11:46
| #4 | |
| | Eigenleben hier das Log von Silentrunners in zwei posts da es zu lang ist: Teil 1: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "msnmsgr" = ""C:\Programme\MSN Messenger\msnmsgr.exe" /background" [MS] "SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"] "GMX_GMX MultiMessenger" = ""C:\Programme\GMX\GMX MultiMessenger\MESSENGR.EXE" /hide" ["GMX GmbH"] "rectup" = "C:\DOKUME~1\Jo\ANWEND~1\DOESLO~1\First team.exe" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ehTray" = "C:\WINDOWS\ehome\ehtray.exe" [MS] "Verknüpfung mit der High Definition Audio-Eigenschaftenseite" = "HDAShCut.exe" ["Windows (R) Server 2003 DDK provider"] "SunJavaUpdateSched" = "C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe" [null data] "SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."] "AlcWzrd" = "ALCWZRD.EXE" ["RealTek Semicoductor Corp."] "Alcmtr" = "ALCMTR.EXE" ["Realtek Semiconductor Corp."] "ATIPTA" = "C:\ATI-CPanel\atiptaxx.exe" ["ATI Technologies, Inc."] "Norton Ghost 9.0" = "C:\Programme\Symantec\Norton Ghost\Agent\GhostTray.exe" ["Symantec Corporation"] "ccApp" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"" ["Symantec Corporation"] "Adobe Version Cue CS2" = ""C:\Programme\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"" ["Adobe Sytems Incorporated"] "Atomuhr Synchronisation" = "PTBSync.EXE /Start" ["ElmüSoft"] "ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"" [null data] "NeroFilterCheck" = "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "Acrobat Assistant 7.0" = ""C:\Programme\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"" ["Adobe Systems Inc."] "KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" "IntelliPoint" = ""C:\Programme\Microsoft IntelliPoint\ipoint.exe"" [MS] "mateSuite Suspend Manager" = "C:\Programme\REINER SCT\mateSuite\mssm.exe" ["REINER SCT, SII"] "Symantec PIF AlertEng" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programme\Gemeinsame Dateien\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"" ["Symantec Corporation"] "CloneCDTray" = ""C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s" ["SlySoft, Inc."] "(Default)" = "(empty string)" [file not found] "QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {1765F51E-F1D0-4AEE-8A8A-A078C9B5BAD4}\(Default) = (no title provided) -> {HKLM...CLSID} = "PassMateBHO Class" \InProcServer32\(Default) = "C:\Programme\REINER SCT\mateSuite\mspmie.dll" [empty string] {53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_11\bin\ssv.dll" ["Sun Microsystems, Inc."] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}\(Default) = "NAV Helper" -> {HKLM...CLSID} = "CNavExtBho Class" \InProcServer32\(Default) = "C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] {AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Conversion Toolbar Helper" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll" ["Adobe Systems Incorporated"] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = (no title provided) -> {HKLM...CLSID} = "Windows Live Toolbar Helper" \InProcServer32\(Default) = "C:\Programme\Windows Live Toolbar\msntb.dll" [MS] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Outlook-Dateisymbolerweiterung" \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS] "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] "{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}" = "OODefrag" -> {HKLM...CLSID} = "OODShellExtObj Class" \InProcServer32\(Default) = "C:\PROGRA~1\OOSOFT~1\DEFRAG~1\oodsh.dll" ["O&O Software GmbH"] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{32020A01-506E-484D-A2A8-BE3CF17601C3}" = "AlcoholShellEx" -> {HKLM...CLSID} = "AlcoholShellEx" \InProcServer32\(Default) = "C:\PROGRA~1\ALCOHO~1\ALCOHO~1\AXShlEx.dll" ["Alcohol Soft Development Team"] "{B327765E-D724-4347-8B16-78AE18552FC3}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{7F1CF152-04F8-453A-B34C-E609530A9DC8}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "C:\Programme\MSN Messenger\fsshext.8.0.0812.00.dll" [MS] "{20082881-FC36-4E47-9A7A-644C95FF749F}" = "IntelliPoint Wireless Control Panel Property Page" -> {HKLM...CLSID} = "Schnurlose Eigenschaften" \InProcServer32\(Default) = ""C:\Programme\Microsoft IntelliPoint\ipcplwir.dll"" [MS] "{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE}" = "IntelliPoint Wheel Control Panel Property Page" -> {HKLM...CLSID} = "Scrollrad-Eigenschaftenseite" \InProcServer32\(Default) = ""C:\Programme\Microsoft IntelliPoint\ipcplwhl.dll"" [MS] "{653DCCC2-13DB-45B2-A389-427885776CFE}" = "IntelliPoint Activities Control Panel Property Page" -> {HKLM...CLSID} = "Aktivitäten-Eigenschaftenseite" \InProcServer32\(Default) = ""C:\Programme\Microsoft IntelliPoint\ipcplact.dll"" [MS] "{124597D8-850A-41AE-849C-017A4FA99CA2}" = "IntelliPoint Buttons Control Panel Property Page" -> {HKLM...CLSID} = "Tasten-Eigenschaftenseite" \InProcServer32\(Default) = ""C:\Programme\Microsoft IntelliPoint\ipcplbtn.dll"" [MS] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Programme\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" = "TuneUp Shredder Shell Extension" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] "{44440D00-FF19-4AFC-B765-9A0970567D97}" = "TuneUp Theme Extension" -> {HKLM...CLSID} = "TuneUp Theme Extension" \InProcServer32\(Default) = "C:\WINDOWS\System32\uxtuneup.dll" ["TuneUp Software GmbH"] "{E8CF73E1-2D2B-465D-9740-8E85349FD65A}" = "DOPMenu" -> {HKLM...CLSID} = "DOPMenu" \InProcServer32\(Default) = "C:\Programme\DxO Labs\DxO Optics Pro v4\DOPMenu.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\System\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"OODBS" ["O&O Software GmbH"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7D4D6379-F301-4311-BEBA-E26EB0561882}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" -> {HKLM...CLSID} = "Acrobat Elements Context Menu" \InProcServer32\(Default) = "C:\Programme\Adobe\Adobe Acrobat 7.0\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Programme\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] DOPMenu\(Default) = "{E8CF73E1-2D2B-465D-9740-8E85349FD65A}" -> {HKLM...CLSID} = "DOPMenu" \InProcServer32\(Default) = "C:\Programme\DxO Labs\DxO Optics Pro v4\DOPMenu.dll" [null data] MyPhoneExplorer\(Default) = "{6863F1C7-E13A-481E-BF9C-5C8F01AF74E5}" -> {HKLM...CLSID} = "MyPhoneExplorer_ShellEx.ShellExt" \InProcServer32\(Default) = "C:\Programme\MyPhoneExplorer\DLL\ShellMgr.dll" ["F.J. Wechselberger"] OODefrag\(Default) = "{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}" -> {HKLM...CLSID} = "OODShellExtObj Class" \InProcServer32\(Default) = "C:\PROGRA~1\OOSOFT~1\DEFRAG~1\oodsh.dll" ["O&O Software GmbH"] SimpleShlExt\(Default) = "{42CEC90D-1358-4B95-918E-7F5F1FD884EA}" -> {HKLM...CLSID} = "CFileMateWinShellExt Class" \InProcServer32\(Default) = "C:\Programme\REINER SCT\mateSuite\msfmwex.dll" [empty string] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ DOPMenu\(Default) = "{E8CF73E1-2D2B-465D-9740-8E85349FD65A}" -> {HKLM...CLSID} = "DOPMenu" \InProcServer32\(Default) = "C:\Programme\DxO Labs\DxO Optics Pro v4\DOPMenu.dll" [null data] TuneUp Shredder Shell Extension\(Default) = "{4858E7D9-8E12-45a3-B6A3-1CD128C9D403}" -> {HKLM...CLSID} = "TuneUp Shredder Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\TUNEUP~1\SDShelEx-win32.dll" ["TuneUp Software GmbH"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ OODefrag\(Default) = "{48EAD1E1-ECF2-4a85-AA09-1C44FBEED451}" -> {HKLM...CLSID} = "OODShellExtObj Class" \InProcServer32\(Default) = "C:\PROGRA~1\OOSOFT~1\DEFRAG~1\oodsh.dll" ["O&O Software GmbH"] SimpleShlExt\(Default) = "{42CEC90D-1358-4B95-918E-7F5F1FD884EA}" -> {HKLM...CLSID} = "CFileMateWinShellExt Class" \InProcServer32\(Default) = "C:\Programme\REINER SCT\mateSuite\msfmwex.dll" [empty string] Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{FAD61B3D-699D-49B2-BE16-7F82CB4C59CA}" -> {HKLM...CLSID} = "IEContextMenu Class" \InProcServer32\(Default) = "C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoLowDiskSpaceChecks" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000001 {unrecognized setting} "NoDrives" = (REG_BINARY) hex:00 00 00 00 {unrecognized setting} "NoSharedDocuments" = (REG_BINARY) hex:00 00 00 00 {User Configuration|Administrative Templates|Windows Components|Windows Explorer| Remove Shared Documents from My Computer} "NoRecentDocsHistory" = (REG_DWORD) hex:0x00000001 {unrecognized setting} "NoRecentDocsNetHood" = (REG_DWORD) hex:0x00000001 {unrecognized setting} "NoViewOnDrive" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "MemCheckBoxInRunDlg" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoCDBurning" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\ "Colors" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "InstallVisualStyle" = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles {unrecognized setting} "InstallTheme" = (REG_EXPAND_SZ) C:\WINDOWS\Resources\Themes\Royale.theme {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "%APPDATA%\IrfanView\IrfanView_Wallpaper.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Dokumente und Einstellungen\Jo\Anwendungsdaten\IrfanView\IrfanView_Wallpaper.bmp" Startup items in "Jo" & "All Users" startup folders: ---------------------------------------------------- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "Adobe Gamma" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe" ["Adobe Systems, Inc."] "hpoddt01.exe" -> shortcut to: "C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" ["Hewlett-Packard"] "Lexware Info Service" -> shortcut to: "C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe /autostart" [null data] Zitat:
|
|
14.07.2007, 11:49
| #5 | |
| | Eigenleben und hier das Ergebnis von ordner.bat: Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: D0D9-F975 Verzeichnis von C:\Dokumente und Einstellungen\All Users\Anwendungsdaten 15.01.2007 20:06 <DIR> Adobe 07.10.2006 22:27 <DIR> Adobe Systems 11.07.2007 23:53 <DIR> Ahead 07.10.2006 23:57 <DIR> CyberLink 15.05.2007 21:11 <DIR> GMX 21.10.2006 10:28 <DIR> InstallShield 12.05.2007 12:03 <DIR> Lexware 02.02.2007 22:06 <DIR> Microsoft Corporation 11.07.2007 23:49 <DIR> Nero 09.06.2007 21:17 <DIR> PACE Anti-Piracy 19.12.2006 17:46 <DIR> QuickTime 14.07.2007 11:04 <DIR> SecTaskMan 03.03.2007 11:19 <DIR> Spybot - Search & Destroy 27.04.2007 18:25 <DIR> Symantec 16.04.2007 23:54 <DIR> Trymedia 20.10.2006 22:55 <DIR> TuneUp Software 08.10.2006 10:22 <DIR> Ulead Systems 03.10.2006 19:51 <DIR> Windows Genuine Advantage 20.12.2006 21:40 <DIR> Windows Live Toolbar 07.07.2007 08:53 <DIR> World Money 0 Datei(en) 0 Bytes 20 Verzeichnis(se), 17.194.807.296 Bytes frei Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: D0D9-F975 Verzeichnis von C:\Dokumente und Einstellungen\Jo\Anwendungsdaten 05.11.2006 03:44 <DIR> Adobe 16.01.2007 16:02 <DIR> AdobeUM 17.12.2006 22:54 <DIR> Ahead 08.10.2006 08:37 <DIR> ATI 12.07.2007 20:34 <DIR> Azureus 16.12.2006 03:49 <DIR> BitRoll 10.06.2007 15:21 <DIR> Buhl 08.10.2006 00:22 <DIR> DataDesign 14.07.2007 00:36 <DIR> Does Load Balm 15.05.2007 21:11 <DIR> GMX 18.03.2007 13:15 <DIR> Google 11.10.2006 23:34 <DIR> Help 08.10.2006 18:34 <DIR> Hemera 03.10.2006 18:59 <DIR> Hewlett-Packard 03.10.2006 18:10 <DIR> Identities 22.10.2006 10:12 <DIR> ieSpell 12.05.2007 12:03 <DIR> InstallShield 08.10.2006 20:58 <DIR> InterVideo 04.02.2007 23:25 <DIR> IrfanView 03.10.2006 19:55 <DIR> IsolatedStorage 18.01.2007 01:19 <DIR> Lavasoft 12.05.2007 12:11 <DIR> Lexware 28.10.2006 12:56 <DIR> Macromedia 14.01.2007 18:22 <DIR> Media Player Classic 15.10.2006 10:05 <DIR> Mozilla 15.10.2006 10:05 <DIR> MozillaControl 20.12.2006 20:37 <DIR> MSNInstaller 28.04.2007 07:59 <DIR> MusicIP 05.07.2007 00:02 <DIR> MyPhoneExplorer 09.06.2007 21:17 <DIR> PACE Anti-Piracy 17.01.2007 23:38 <DIR> SlySoft 10.02.2007 13:01 <DIR> Sony Ericsson 03.10.2006 18:04 <DIR> Sun 09.10.2006 12:01 <DIR> Symantec 10.02.2007 13:01 <DIR> Teleca 01.01.2007 16:28 <DIR> The Labyrinth Plus! Edition 20.10.2006 22:40 <DIR> TuneUp Software 23.10.2006 23:36 <DIR> Ulead Systems 25.10.2006 21:56 <DIR> vlc 14.07.2007 11:41 <DIR> WholeSecurity 0 Datei(en) 0 Bytes 40 Verzeichnis(se), 17.194.807.296 Bytes frei Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: D0D9-F975 Verzeichnis von C:\Windows\tasks 13.07.2007 17:17 390 1-Klick-Wartung.job 14.07.2007 11:41 240 Auf Updates fr Windows Live Toolbar prfen.job 03.12.2006 23:00 340 FRU Task #Hewlett-Packard#hp officejet 6100 series#1159894670.job 14.07.2007 08:44 586 Norton AntiVirus - Vollst„ndige Systemprfung ausfhren - Jo.job 09.04.2007 12:01 278 Norton SystemWorks One Button Checkup.job 14.07.2007 00:00 306 Symantec Drmc.job 6 Datei(en) 2.140 Bytes 0 Verzeichnis(se), 17.194.807.296 Bytes frei Ich hoffe Du kannst mir mit diesen Angaben nun weiterhelfen. Gruß Jens Zitat:
|
|
14.07.2007, 13:23
| #6 |
| | Eigenleben Hallo arbeite bitte diese Anleitung zum Swizzor entfernen ab, relevanter Eintrag für dich ist : O4 - HKCU\..\Run: [rectup] C:\DOKUME~1\Jo\ANWEND~1\DOESLO~1\First team.exe Wenn du dich im abgesicherten Modus befindest kannst du diesen Ordner gleich löschen : C:\Dokumente und Einstellungen\Jo\Anwendungsdaten\Does Load Balm\ Nach der Bereinigung erstelle ein neues Hijackthis.log, benenne aber bitte die Hijackthis.exe um in z.B. ABC.exe MFG |
|
14.07.2007, 23:07
| #7 | |
| | Eigenleben Vielen Dank, das schein es gewesen zu sein. Als träger des Swizzors vermute ich mal einen Messenger. Habe ihn deinstalliert und bin der Anleitung gefolgt. Einzig was momentan noch passiert, das beim Spielen der Ton immer wieder mal aus geht. Debei wird er einfach immer leiser bis er komplett weg ist. Hast Du zufällig dazu eine Idee ? Gruß Jens Zitat:
|
|
15.07.2007, 09:08
| #8 | |
| | Eigenleben Hallo Zitat:
Poste bitte noch ein HijackThis log wie oben gewünscht, ich würde dir noch einen Onlinescan bei Kostenloses Online-Virenschutzprogramm. ActiveScan. Panda Software. oder Trend Micro HouseCall - Start (eventuell muss die Onlineüberprüfung mit dem InternetExplorer durchgeführt werden, dann musst du ActivX erlauben) anraten neben dem scan mit deinem Antivirenprogramm. MFG |
|
| Themen zu Eigenleben |
| adobe, antivirus, bho, drivers, eigenleben, einstellungen, explorer, firewall, google, helper, hijack, hijackthis, ie fenster, internet, internet explorer, konvertieren, lautstärke, lexware, logfile, neu, outlook express, pdf, pdf-datei, programme, protection center, security, software, suche, symantec, synchronisation, system, tan, temp, tuneup utilities, wickel, windows, windows xp |
Hybrid-Darstellung
