| |
| |||||||
Log-Analyse und Auswertung: RUNDLL; Error loading ...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
25.10.2007, 09:00
| #1 |
| |  RUNDLL; Error loading ... Guten Tag, Ich habe folgendes Problem. Ich erhielt einen Virenverseuchten Laptop (IMB ThinkPad R50e) von einer Mitarbeiterin. Ich liess erst mal verschiedene AntiVirus Programme durchlaufen: Norman, Ad-Aware, a-squared . Zuerst wurden mal ca. 80 Viren gefunden. Nach einigen AntiVirus durchläufen war der pc wieder sauber. Auch Reparaturinstallation von Windows xp durchgeführt. Jetzt kommt jedesmal folgende Errormeldung nach dem Bootvorgang(Screenshot anbei): RUNDLL Error loading C:\Windows\system32\sydphwlj.dll The specified module could not be found. Auch bei Google nichts über sydphwlj.dll gefunden. Hier noch das HJT-Logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:30:15, on 25/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Norman\Npm\Bin\eLogsvc.exe C:\Program Files\Norman\Npm\Bin\Zanda.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe C:\WINDOWS\System32\QCONSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Citrix\ICA Client\ssonsvr.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Norman\Npm\bin\NJEEVES.EXE C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE C:\Program Files\Norman\Nvc\bin\nvcoas.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\tp4serv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\IBM\Messages By IBM\ibmmessages.exe C:\IBMTOOLS\UTILS\ibmprc.exe C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Norman\Npm\bin\ZLH.EXE C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Norman\Nvc\BIN\NIP.EXE C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Norman\Nvc\bin\cclaw.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Norman\Nvc\BIN\nvcod.exe C:\Program Files\a-squared Free\a2free.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\uklap\Desktop\HiJackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.karoo.co.uk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Karoo R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.karoo.co.uk:8080 O1 - Hosts: 172.16.1.1 CHCTE001 O1 - Hosts: 172.16.5.1 srvdom03 srvdom03.cwemea.local O1 - Hosts: 172.16.5.4 srvback01 srvback01.cwemea.local O1 - Hosts: 172.16.5.5 srvback02 srvback02.cwemea.local # Tapeloader O1 - Hosts: 172.16.5.7 srvmgm02 srvmgm02.cwemea.local O1 - Hosts: 172.16.5.9 srvdst02 srvdst02.cwemea.local O1 - Hosts: 172.16.5.13 srvsnap01 srvsnap01.cwemea-local O1 - Hosts: 172.16.5.14 srvsnap02 srvsnap02.cwemea.local O1 - Hosts: 172.16.5.15 srvfmk01 srvfmk01.cwemea.local O1 - Hosts: 172.16.5.16 srvdst01 srvdst01.cwemea.local O1 - Hosts: 172.16.5.53 srvterm03 srvterm03.cwemea.local O1 - Hosts: 172.16.5.54 srvterm04 srvterm04.cwemea.local O1 - Hosts: 172.16.5.57 srvterm07 srvterm07.cwemea.local O1 - Hosts: 172.16.10.10 srvfra01 srvfra01.ch.coltene.net O1 - Hosts: 172.16.7.16 srvintra02 srvintra02.ch.coltene.net O1 - Hosts: 172.16.7.19 srvabac01 srvabac01.ch.coltene.net O1 - Hosts: 172.16.7.21 srvmom01 srvmom01.ch.coltene.net O1 - Hosts: 172.16.7.22 srvterm01 srvterm01.ch.coltene.net O1 - Hosts: 172.16.7.23 srvterm02 srvterm02.ch.coltene.net O1 - Hosts: 172.16.7.25 srvmail01 srvmail01.ch.coltene.net O1 - Hosts: 172.16.7.27 srvintra01 srvintra01.ch.coltene.net O1 - Hosts: 172.16.7.28 srvterm05 srvterm05.ch.coltene.net O1 - Hosts: 172.16.7.29 srvterm06 srvterm06.ch.coltene.net O1 - Hosts: 172.16.7.35 srvsync01 srvsync01.ch.coltene.net O1 - Hosts: 172.16.7.36 srvdom01 srvdom01.ch.coltene.net O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {35F2451A-B4A8-4FED-855B-64A13C7C54CD} - C:\WINDOWS\system32\ljjkj.dll (file missing) O2 - BHO: (no name) - {41E9FE6E-B690-4016-B70C-92514B6814AA} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {6C201DB7-2C1D-4B18-ACB0-880E38107AAB} - (no file) O2 - BHO: (no name) - {79873e3f-a487-4f2a-a677-603bd6b22d6a} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: {f8450354-7a2e-eaba-85c4-9354e190113b} - {b311091e-4539-4c58-abae-e2a74530548f} - C:\WINDOWS\system32\cbmoxlgp.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [c8f59304] rundll32.exe "C:\WINDOWS\system32\sydphwlj.dll",sitypnow O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe O4 - Global Startup: Digital Line Detect.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java141\jre\bin\NPJPI141.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [JAVA_IBM] Java (IBM) O14 - IERESET.INF: START_PAGE_URL=http://www.karoo.co.uk/ O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137678001781 O16 - DPF: {705EC6D4-B138-4079-A307-EF13E40C2416} (InstallerWeb Control) - O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cwemea.local O17 - HKLM\Software\..\Telephony: DomainName = cwemea.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cwemea.local O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cwemea.local O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: byvtu - C:\WINDOWS\system32\byvtu.dll (file missing) O20 - Winlogon Notify: efeee - C:\WINDOWS\system32\efeee.dll (file missing) O20 - Winlogon Notify: hgdee - C:\WINDOWS\system32\hgdee.dll (file missing) O20 - Winlogon Notify: iifef - C:\WINDOWS\system32\iifef.dll (file missing) O20 - Winlogon Notify: ljjkj - C:\WINDOWS\system32\ljjkj.dll (file missing) O20 - Winlogon Notify: mljkh - C:\WINDOWS\system32\mljkh.dll (file missing) O20 - Winlogon Notify: rqomm - C:\WINDOWS\system32\rqomm.dll (file missing) O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing) O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe -- End of file - 14052 bytes Ich hoffe ihr könnt mir helfen, Freundliche Grüsse Kenshj91 |
|
25.10.2007, 09:29
| #2 |
| /// Helfer-Team    | RUNDLL; Error loading ... Hi,
__________________ziemliche Seuchenkiste. Reparaturinstallation hat den Vorteil, dass installierte Software bleibt, dazu den großen Nachteil, dass Windows dabei nicht zwischen gut und böse unterscheidet. Damit sinnvoll für ein zerschossenes Windows, in solchen Fällen hier eigentlich nicht. Code:
ATTFilter O4 - HKLM\..\Run: [c8f59304] rundll32.exe "C:\WINDOWS\system32\sydphwlj.dll",sitypnow
Code:
ATTFilter O2 - BHO: (no name) - {35F2451A-B4A8-4FED-855B-64A13C7C54CD} - C:\WINDOWS\system32\ljjkj.dll (file missing)
O2 - BHO: (no name) - {41E9FE6E-B690-4016-B70C-92514B6814AA} - (no file)
O2 - BHO: (no name) - {6C201DB7-2C1D-4B18-ACB0-880E38107AAB} - (no file)
O2 - BHO: (no name) - {79873e3f-a487-4f2a-a677-603bd6b22d6a} - (no file)
O2 - BHO: {f8450354-7a2e-eaba-85c4-9354e190113b} - {b311091e-4539-4c58-abae-e2a74530548f} - C:\WINDOWS\system32\cbmoxlgp.dll (file missing)
O20 - Winlogon Notify: byvtu - C:\WINDOWS\system32\byvtu.dll (file missing)
O20 - Winlogon Notify: efeee - C:\WINDOWS\system32\efeee.dll (file missing)
O20 - Winlogon Notify: hgdee - C:\WINDOWS\system32\hgdee.dll (file missing)
O20 - Winlogon Notify: iifef - C:\WINDOWS\system32\iifef.dll (file missing)
O20 - Winlogon Notify: ljjkj - C:\WINDOWS\system32\ljjkj.dll (file missing)
O20 - Winlogon Notify: mljkh - C:\WINDOWS\system32\mljkh.dll (file missing)
O20 - Winlogon Notify: rqomm - C:\WINDOWS\system32\rqomm.dll (file missing)
Die O2-Einträge sind vermutlich ok, ich hoffe Du hast das Insiderwissen, das zu prüfen. Ebenso O17. Computer neu starten, Hijackthis.exe in hjt.exe umbenennen und damit ein neues Log anfertigen. Gruß, Karl |
|
25.10.2007, 09:32
| #3 |
| | RUNDLL; Error loading ... Hey,
__________________Danke fuer die superschnelle Hilfe, werd das ma machen mit HJT. Geb dann Bescheid Thx btw: super forum hier! |
|
25.10.2007, 10:09
| #4 |
| | RUNDLL; Error loading ... Hey ! Nochmals Danke für die schnelle Hilfe. Die Fehlermeldung erscheint nicht mehr! Java-Update gemacht und den Rest hab ich auch überprüft.. Scheint sonst alles in Ordnung zu sein. Vielen Dank nochmal , Kenshj91 |
|
| Themen zu RUNDLL; Error loading ... |
| ad-aware, adobe, antivirus, appinit_dlls, application, bho, bootvorgang, computer, desktop, diagnostics, downloader, error, excel, explorer, google, helfen, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, monitor, norman, object, photoshop, rundll, s-1-5-18, software, system, thomson, trend micro, usb, windows, windows xp |
