| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: HILFE, wenn ich etwas anklicke geht es nicht auf!!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
01.06.2008, 09:49
| #1 |
 |  HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi! Habe folgendes Problem, ich klicke auf das rote x oben Zum beispiel und dann passiert erstmal nix.. Dann versuch ich nochmal, un dann geht das dahinter stehende fenster auch zu   Das stört mich extremst, genauso wie ich wenn ich mit paint ein paar fotos bearbeite und es markieren will, Dann hört das markieren einfach auf, obwohl ich weiter drauf bleibe auf meiner maus. Hab eine Laser maus Mx Laser von logitech. ich denk langsam das dass ein WURM oder virus ist... der das macht, da mein pc viel langsamer ist als am anfang, habe Windows Vista Professional, dann noch eine sehr gutes anti vir programm ( voll version ) Und spybot - search and destroy. Hier schaut euch bitte mein Highjackthis log an. Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:24:14, on 07.01.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam10\QuickCam10.exe C:\Program Files\Common Files\AOL\1196511391\ee\aolsoftware.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe C:\Windows\System32\mobsync.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://de.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://de.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE" O4 - HKLM\..\Run: [recinfo818] c:\RecInfo\RecInfo.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1196511391\ee\AOLSoftware.exe O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080101 O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Vorlesen - C:\Program Files\ReadABit\readselection.htm O8 - Extra context menu item: Öffnen mit WordPerfect - c:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe O9 - Extra 'Tools' menuitem: &Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} (Attachment Upload Control) - https://stream.web.de/mail/activex/mail_upload_11213.cab O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.schuelervz.net/photouploader/ImageUploader4.cab?nocache=20071128-1 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1F6C218E-3275-4A32-8734-634C2209A637}: NameServer = 217.237.151.142 217.237.150.188 O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKWCtl.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ProtexisLicensing - Unknown owner - c:\Windows\system32\PSIService.exe O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- End of file - 10369 bytes ich hoffe ihr könnt mir helfen... Bin sehr ratlos... da es immer der fall ist, und meine maus ging immer. Daher wunder ich mich so.. Dann hängt mein pc manchmal * OBWOHL über 100 gb gb speicher frei sind, auf der einen 141gb auf der anderen 107 gb Wenn ich etwas kopiere auch es versuche , dann Kopiert er nicht, und es ist meistens garnix dann drin oder das davorige wo ich kopiert hatte.. Auch wenn ich Text Sachen markiere ( alles) stoppt er dazwischen, und markiert nur die hälfte oder 1 wort..   Dazu muss ich noch sagen spybot - search and destroy hat ein virus oder sowas gefunden es heißt doubleClick , Mediaplex , Memedia.adventage , tradedoubler... Hoffe ihr helft mir ausführlich, Bitte. Thx schonmal für alle antworten die kommen (hoffentlich)  Mfg euer derritter224  |
|
02.06.2008, 05:31
| #2 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hallo,
__________________Bitte lasse folgende datein auf VirusTotal - Free Online Virus and Malware Scan oder Online malware scan auswerten poste das komplette ergebnis! Code:
ATTFilter c:\RecInfo\RecInfo.exe
C:\ProgramData\fsc-reg\fscreg.exe
|
|
02.06.2008, 19:35
| #3 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi Cecilli, Thx für deine antwort
__________________1.datei: Ich habe in dem ordner nur die datei hier gefunden RecInfo.exe.manifest <- die habe ich gescannt das hier ist dabei rausgekommen beim ersten. Code:
ATTFilter Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.5.30.1 2008.06.02 -
AntiVir 7.8.0.26 2008.06.02 -
Authentium 5.1.0.4 2008.06.01 -
Avast 4.8.1195.0 2008.06.02 -
AVG 7.5.0.516 2008.06.02 -
BitDefender 7.2 2008.06.02 -
CAT-QuickHeal 9.50 2008.06.02 -
ClamAV 0.92.1 2008.06.02 -
DrWeb 4.44.0.09170 2008.06.02 -
eSafe 7.0.15.0 2008.06.02 -
eTrust-Vet 31.4.5842 2008.06.02 -
Ewido 4.0 2008.06.02 -
F-Prot 4.4.4.56 2008.06.01 -
F-Secure 6.70.13260.0 2008.06.02 -
Fortinet 3.14.0.0 2008.06.02 -
GData 2.0.7306.1023 2008.06.02 -
Ikarus T3.1.1.26.0 2008.06.02 -
Kaspersky 7.0.0.125 2008.06.02 -
McAfee 5307 2008.05.30 -
Microsoft 1.3520 2008.06.02 -
NOD32v2 3152 2008.06.02 -
Norman 5.80.02 2008.06.02 -
Panda 9.0.0.4 2008.06.02 -
Prevx1 V2 2008.06.02 -
Rising 20.47.02.00 2008.06.02 -
Sophos 4.29.0 2008.06.02 -
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.06.02 -
TheHacker 6.2.92.331 2008.06.02 -
VBA32 3.12.6.6 2008.06.01 -
VirusBuster 4.3.26:9 2008.06.02 -
Webwasher-Gateway 6.6.2 2008.06.02 -
Die 2.Datei find ich garnicht auf C: habe alles durchgesucht, Dann muss ich noch sagen , das Markier problem geht manchmal, aber dann nach 10 min trit es wieder auf! Wie als wenn der virus pausen einlegt. ( wenn es ein virus ist ) Hier mal wieder ein Highjackthis log. Hab ja ein paar dateien fixed gemacht. Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:24:14, on 07.01.2008 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16575) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam10\QuickCam10.exe C:\Program Files\Common Files\AOL\1196511391\ee\aolsoftware.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe C:\Windows\System32\mobsync.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://de.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://de.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://de.search.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O1 - Hosts: ::1 localhost O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVKTray] "C:\Programme\G DATA AntiVirenKit 2007 Trial\AVKTray\AVKTray.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [QuickFinder Scheduler] "c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE" O4 - HKLM\..\Run: [recinfo818] c:\RecInfo\RecInfo.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1196511391\ee\AOLSoftware.exe O4 - HKLM\..\Run: [ICQ Lite] "C:\Program Files\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080101 O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0 VR\AOL.EXE" -b O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: Vorlesen - C:\Program Files\ReadABit\readselection.htm O8 - Extra context menu item: Öffnen mit WordPerfect - c:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Program Files\Common Files\WebSpeech.4.0\LgxIEBar.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe O9 - Extra button: Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe O9 - Extra 'Tools' menuitem: &Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe O13 - Gopher Prefix: O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} (Attachment Upload Control) - https://stream.web.de/mail/activex/mail_upload_11213.cab O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://static.ak.schuelervz.net/photouploader/ImageUploader4.cab?nocache=20071128-1 O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1F6C218E-3275-4A32-8734-634C2209A637}: NameServer = 217.237.151.142 217.237.150.188 O23 - Service: AntiVir PersonalEdition Premium MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe O23 - Service: AntiVir PersonalEdition Premium Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\sched.exe O23 - Service: AntiVir PersonalEdition Premium Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avguard.exe O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AntiVir PersonalEdition Premium MailGuard Hilfsdienst (AVEService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe O23 - Service: AVKProxy - G DATA Software AG - C:\Program Files\Common Files\G DATA\AVKProxy\AVKProxy.exe O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\Programme\G DATA AntiVirenKit 2007 Trial\AVK\AVKWCtl.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: ProtexisLicensing - Unknown owner - c:\Windows\system32\PSIService.exe O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe O23 - Service: UPnPService - Magix AG - C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- End of file - 10369 bytes Hier der maleware test Malwarebytes' Anti-Malware 1.14 Datenbank Version: 815 20:32:24 02.06.2008 mbam-log-6-2-2008 (20-32-24).txt Scan Art: Komplett Scan (C:\|D:\|) Objekte gescannt: 163668 Scan Dauer: 35 minute(s), 33 second(s) Infizierte Speicher Prozesse: 0 Infizierte Speicher Module: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Datei Objekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicher Prozesse: (Keine Malware Objekte gefunden) Infizierte Speicher Module: (Keine Malware Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine Malware Objekte gefunden) Infizierte Registrierungswerte: (Keine Malware Objekte gefunden) Infizierte Datei Objekte der Registrierung: (Keine Malware Objekte gefunden) Infizierte Verzeichnisse: (Keine Malware Objekte gefunden) Infizierte Dateien: (Keine Malware Objekte gefunden) verstehe nicht wieso er da nichts findet. das problem ist immernoch da  denkt ihr es ist was an den einstellungen hier falsch?? Bitte sagt mir auch wieso das i-net fenster immer so klein ist wenn ich auf mein internet explorer klicke, wie ich das so einstelle das es wieder groß aufgeht. mfg |
|
02.06.2008, 21:55
| #4 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! OH GOTT ich dreh noch durch... das ist so scheisse wenn man was anklickt ( egal was , geht es erst nach 10 klicks auf... )   das regt mich übelst auf... Und meine fenster sind immer so klein ( wenn ein link sich öffnet ) man muss es erst groß machen (( *verzweifelt ist* |
|
03.06.2008, 20:41
| #5 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi leute, ich bin grade dabei sehr sehr viel von meinem computer zu löschen.. Ich mein damit unnötige sachen, wie bilder, alte musik dateien ( hab leider nie alles gelöscht  deswegen fliegt das alles auf meinem pc rum )Wenn ich damit fertig bin, denke es dauert jetz noch ca. 40 min. Dann mach ich nochmal scans. Aber bitte helft mir bitte... Weiß echt nicht weiter was das ist...  Bitte bitte...... Mfg derritter224 |
|
03.06.2008, 20:54
| #6 | |
  | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi Also bitte fixe mit HijackThis folgende Einträge: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [recinfo818] c:\RecInfo\RecInfo.exe O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080101 O8 - Extra context menu item: Vorlesen - C:\Program Files\ReadABit\readselection.htm O9 - Extra button: Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe O9 - Extra 'Tools' menuitem: &Seite vorlesen - {DD69FD11-3C84-4309-B4E4-D599D4C012CC} - C:\Program Files\ReadABit\Reader.exe Bitte lade folgende Dateien bei Jotti oder Virustotal hoch und poste das Ergebniss: C:\ProgramData\fsc-reg\fscreg.exe 20080101 c:\RecInfo\RecInfo.exe C:\Program Files\ReadABit\Reader.exe Zitat:
http://research.sunbelt-software.com...hreatid=186832 Geändert von trojan-death (03.06.2008 um 21:00 Uhr) |
|
04.06.2008, 04:25
| #7 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi, melde mich zurück.. hab hier so ne art logfile von Spybot. Der ist aber sehr groß! von daher poste ich hier nur ein paar teile Code:
ATTFilter --- Search result list ---
MeMedia.AdVantage: [SBI $EE985419] Anwendungs-ID (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\AppID\{69E0089F-28BC-4BB5-862B-E2B07C3B83C6}
MeMedia.AdVantage: [SBI $CAD809BD] Anwendungs-ID (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\AppID\TR.DLL
MeMedia.AdVantage: [SBI $EC2A980C] Interface (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\Interface\{5AC3A9EF-C0F8-41D4-B4E2-B7CEBB794151}
MeMedia.AdVantage: [SBI $0222F139] Interface (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\Interface\{862DEF42-89AA-49FA-AE1F-8A84B1B08A17}
MeMedia.AdVantage: [SBI $337B07C5] Interface (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\Interface\{F6E4845D-1D13-4BC0-942D-B9191524CC48}
MeMedia.AdVantage: [SBI $E0E6B2C4] Root class (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MEAD.1
MeMedia.AdVantage: [SBI $695898C7] Type library (Registrierungsdatenbank-Schlüssel, fixing failed)
HKEY_CLASSES_ROOT\TypeLib\{DABF362D-D442-4402-9208-CA9ED70DD01E}
Code:
ATTFilter DoubleClick: Verfolgender Cookie (Internet Explorer: Robin) (Cookie, fixed)
MediaPlex: Verfolgender Cookie (Internet Explorer: Robin) (Cookie, fixed)
Code:
ATTFilter --- System information ---
Windows Vista (Build: 6000) (6.0.6000)
--- Startup entries list ---
Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
size: 40048
MD5: 66D4456C920E21BD2188F8CC33680DF5
Located: HK_LM:Run, avgnt
command: "C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" /min
file: C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe
size: 262401
MD5: 42A1FA44622A6E247EB6FF5C4ADCC0FE
Located: HK_LM:Run, Corel Photo Downloader
command: "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
file: C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
size: 531272
MD5: C9D4451B13578840134FB9F2A23F0A86
Located: HK_LM:Run, HostManager
command: C:\Program Files\Common Files\AOL\1196511391\ee\AOLSoftware.exe
file: C:\Program Files\Common Files\AOL\1196511391\ee\AOLSoftware.exe
size: 50736
MD5: F07143214043E05E373C009D448D9CA6
Located: HK_LM:Run, HP Software Update
command: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
file: C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
size: 49152
MD5: B93C4070F24E46B0097648C276B5039E
Located: HK_LM:Run, ICQ Lite
command: "C:\Program Files\ICQLite\ICQLite.exe" -minimize
file: C:\Program Files\ICQLite\ICQLite.exe
size: 3144800
MD5: C0F38029C013894B668AECA496F6DB50
Located: HK_LM:Run, LogitechCommunicationsManager
command: "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe"
file: C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe
size: 284184
MD5: 305E20E5C325D8D5F44BFBF229B9DC7C
Located: HK_LM:Run, LogitechQuickCamRibbon
command: "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
file: C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
size: 746520
MD5: 2E44EE2294BA07D4E58EAE9BFBB97824
Located: HK_LM:Run, LVCOMSX
command: "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe"
file: C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe
size: 244512
MD5: 8A293A35CF99D8EA9058EB9693B00086
Located: HK_LM:Run, NBKeyScan
command: "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
file: C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
size: 2221352
MD5: C7420E7B290E371967F59026E6B014CE
Located: HK_LM:Run, NvCplDaemon
command: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, NvMediaCenter
command: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, NvSvc
command: RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!
Located: HK_LM:Run, QuickFinder Scheduler
command: "c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
file: c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE
size: 83568
MD5: DA6D879F890699D24E50C5CA8901C180
Located: HK_LM:Run, recinfo818
command: c:\RecInfo\RecInfo.exe
file: c:\RecInfo\RecInfo.exe
size: 2768896
MD5: 3A9DE49EF4BED133B49B53A6016C945B
Located: HK_LM:Run, RtHDVCpl
command: RtHDVCpl.exe
file: C:\Windows\RtHDVCpl.exe
size: 4669440
MD5: A659F31AC25418738351E5BDF4C85780
Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
file: C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
size: 144784
MD5: 836DC47E6CAD975304D1D3EB2F516A1C
Located: HK_LM:Run, Ulead AutoDetector v2
command: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
file: C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
size: 95504
MD5: 91BAE648F74B1DB0BCAF24DD9C530BA0
Located: HK_LM:Run, Windows Defender
command: %ProgramFiles%\Windows Defender\MSASCui.exe -hide
file: C:\Program Files\Windows Defender\MSASCui.exe
size: 1006264
MD5: 9AD9E2FB2811123DA13DE84CC154AB77
Located: HK_CU:Run, WMPNSCFG
where: S-1-5-21-1844877249-925019105-2396919201-1000...
command: C:\Program Files\Windows Media Player\WMPNSCFG.exe
file: C:\Program Files\Windows Media Player\WMPNSCFG.exe
size: 201728
MD5: 20EF9002CFF89C4C1077E4415EC7297B
Located: HK_CU:RunOnce, fsc-reg
where: S-1-5-21-1844877249-925019105-2396919201-1000...
command: cmd.exe /c rd /s /q "C:\ProgramData\fsc-reg\"
file: C:\Windows\system32\cmd.exe
size: 320000
MD5: 349CD4318E6E351C9BB72EE13B7CA807
Located: Startup (allgemein), HP Digital Imaging Monitor.lnk
where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
file: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
size: 210520
MD5: 1BA45CDEF852381DA4A95D056DDB4B48
Code:
ATTFilter Browser helper object list ---
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: SSVHelper Class
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: ssv.dll
Short name:
Date (created): 16.03.2008 04:44:34
Date (last access): 22.02.2008 03:33:32
Date (last write): 22.02.2008 05:25:20
Filesize: 509328
Attributes: archive
MD5: 5B42CB6A121256465B251840FDB1B2FE
CRC32: 6EF0BCE9
Version: 6.0.50.13
{7E853D72-626A-48EC-A868-BA8D5E23E045} ()
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name:
{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86} (PhotoPos Pro Toolbar)
location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
BHO name:
CLSID name: PhotoPos Pro Toolbar
Path: C:\PROGRA~1\PHOTOP~2\
Long name: photoposcomtbr.dll
Short name: PHOTOP~1.DLL
Date (created): 16.10.2007 20:58:12
Date (last access): 25.03.2008 16:29:02
Date (last write): 16.10.2007 20:58:12
Filesize: 1923584
Attributes: archive
MD5: 9189E801111E9CFAD9D04C9C4CD41ED4
CRC32: D6F12740
Version: 5.0.1.262
--- ActiveX list ---
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool)
DPF name:
CLSID name: MSN Photo Upload Tool
Installer: C:\Windows\Downloaded Program Files\MSNPUpld.inf
Codebase: http://gfx2.hotmail.com/mail/w2/resources/VistaMSNPUpldde-de.cab
Path: C:\Windows\Downloaded Program Files\
Long name: MsnPUpld.dll
Short name:
Date (created): 20.11.2006 12:04:16
Date (last access): 20.11.2006 12:04:16
Date (last write): 20.11.2006 12:04:16
Filesize: 543544
Attributes: archive
MD5: A0F541D9D2CACEEC7A4A378CD0C31626
CRC32: 035C591F
Version: 10.0.914.0
{59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} (Attachment Upload Control)
DPF name:
CLSID name: Attachment Upload Control
Installer: C:\Windows\Downloaded Program Files\mail_upload.inf
Codebase: https://stream.web.de/mail/activex/mail_upload_11213.cab
Path: C:\Windows\DOWNLO~1\
Long name: mail_upload.ocx
Short name: MAIL_U~1.OCX
Date (created): 21.04.2006 13:43:18
Date (last access): 21.04.2006 13:43:18
Date (last write): 21.04.2006 13:43:18
Filesize: 2461696
Attributes: archive
MD5: 7D69F754B00E09B0018F43A344193DAA
CRC32: F3307A03
Version: 1.1.2.13
{6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control)
DPF name:
CLSID name: Image Uploader Control
Installer: C:\Windows\Downloaded Program Files\ImageUploader4.inf
Codebase: http://static.ak.schuelervz.net/photouploader/ImageUploader4.cab?nocache=20071128-1
Path: C:\Windows\Downloaded Program Files\
Long name: ImageUploader4.ocx
Short name: IMAGEU~1.OCX
Date (created): 24.11.2007 22:24:30
Date (last access): 24.11.2007 22:24:30
Date (last write): 24.11.2007 22:24:30
Filesize: 2684432
Attributes: archive
MD5: 416BA3FCAE4A69AD4BC19EA6AA884882
CRC32: 0872C247
Version: 4.5.70.0
{6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager)
DPF name:
CLSID name: HP Download Manager
Installer: C:\Windows\Downloaded Program Files\HPDEXAXO.inf
Codebase: https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
Path: C:\Windows\Downloaded Program Files\
Long name: HPDEXAXO.dll
Short name:
Date (created): 18.10.2007 11:04:16
Date (last access): 18.10.2007 11:04:16
Date (last write): 18.10.2007 11:04:16
Filesize: 341296
Attributes: archive
MD5: CDE357CD3FC047F5C7D8B8345B6A42BF
CRC32: 7ABDC22F
Version: 1.0.5.1
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: npjpi160_05.dll
Short name: NPJPI1~1.DLL
Date (created): 22.02.2008 03:33:32
Date (last access): 22.02.2008 03:33:32
Date (last write): 22.02.2008 05:25:20
Filesize: 132496
Attributes: archive
MD5: 4FDFB86D78994BD71CBB779A7809E9CD
CRC32: 5A0EB880
Version: 6.0.50.13
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ()
DPF name:
CLSID name:
Installer: C:\Windows\Downloaded Program Files\erma.inf
Codebase: http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
{BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control)
DPF name:
CLSID name: Image Uploader Control
Installer: C:\Windows\Downloaded Program Files\ImageUploader5.inf
Codebase: http://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1206843076
Path: C:\Windows\Downloaded Program Files\
Long name: ImageUploader5.ocx
Short name: IMAGEU~2.OCX
Date (created): 12.02.2008 11:28:20
Date (last access): 12.02.2008 11:28:20
Date (last write): 12.02.2008 11:28:20
Filesize: 3036680
Attributes: archive
MD5: BD29D1E0CE7AB52DA558D3BA4748F860
CRC32: 7BBD5A90
Version: 5.0.40.0
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: ssv.dll
Short name:
Date (created): 16.03.2008 04:44:34
Date (last access): 22.02.2008 03:33:32
Date (last write): 22.02.2008 05:25:20
Filesize: 509328
Attributes: archive
MD5: 5B42CB6A121256465B251840FDB1B2FE
CRC32: 6EF0BCE9
Version: 6.0.50.13
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
DPF name: Java Runtime Environment 1.6.0
CLSID name: Java Plug-in 1.6.0_05
Installer:
Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
Path: C:\Program Files\Java\jre1.6.0_05\bin\
Long name: npjpi160_05.dll
Short name: NPJPI1~1.DLL
Date (created): 22.02.2008 03:33:32
Date (last access): 22.02.2008 03:33:32
Date (last write): 22.02.2008 05:25:20
Filesize: 132496
Attributes: archive
MD5: 4FDFB86D78994BD71CBB779A7809E9CD
CRC32: 5A0EB880
Version: 6.0.50.13
|
|
04.06.2008, 04:29
| #8 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! 2. teil. ( Sorry wenn ich zuviel poste hintereinander aber es geht nicht anderst ) So das hier sind wohl die ganzen dateien. exen. Code:
ATTFilter --- Process list ---
PID: 3664 (1112) C:\Windows\system32\taskeng.exe
size: 166400
MD5: 1226E9FAE5B8508801EC974E3C9D9C14
PID: 3740 (1048) C:\Windows\system32\Dwm.exe
size: 82944
MD5: DEA87D1F171DA986B343C36F773A477D
PID: 3844 (3728) C:\Windows\Explorer.EXE
size: 2923520
MD5: 6D06CD98D954FE87FB2DB8108793B399
PID: 4016 (3844) C:\Program Files\Windows Defender\MSASCui.exe
size: 1006264
MD5: 9AD9E2FB2811123DA13DE84CC154AB77
PID: 3152 (2120) C:\Windows\System32\rundll32.exe
size: 44544
MD5: 4B555106290BD117334E9A08761C035A
PID: 1808 (3700) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
size: 271960
MD5: 85E7BB8A103644085C5C665481022E56
PID: 3332 (7180) C:\Program Files\Internet Explorer\ieuser.exe
size: 301568
MD5: C7E9042E06D75A70DEA2AA86C39907CB
PID: 7092 (4360) C:\Windows\system32\conime.exe
size: 68608
MD5: 05CB3DA78A4BBD9B799A5957F9D101CC
PID: 0 ( 0) [System]
PID: 10304 (11248) C:\Program Files\Windows Media Player\WMPNSCFG.exe
size: 201728
MD5: 20EF9002CFF89C4C1077E4415EC7297B
PID: 11284 (3844) C:\Program Files\Windows Media Player\wmplayer.exe
size: 168960
MD5: 81D386F15E10E19F9A0804D900460324
PID: 11052 (3844) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
size: 5146448
MD5: 2ECA8CDEED7C82F879E766DA92A3561A
PID: 4 ( 0) System
PID: 496 ( 4) smss.exe
size: 62976
PID: 564 ( 552) csrss.exe
size: 7680
PID: 616 ( 552) wininit.exe
size: 95744
PID: 628 ( 608) csrss.exe
size: 7680
PID: 664 ( 616) services.exe
size: 279552
PID: 680 ( 616) lsass.exe
size: 7680
PID: 688 ( 616) lsm.exe
size: 210944
PID: 828 ( 664) svchost.exe
size: 22016
PID: 860 ( 608) winlogon.exe
size: 308224
PID: 924 ( 664) svchost.exe
size: 22016
PID: 968 ( 664) svchost.exe
size: 22016
PID: 1016 ( 664) svchost.exe
size: 22016
PID: 1048 ( 664) svchost.exe
size: 22016
PID: 1084 ( 664) LVPrcSrv.exe
PID: 1112 ( 664) svchost.exe
size: 22016
PID: 1172 (1016) audiodg.exe
size: 88064
PID: 1232 ( 664) SLsvc.exe
size: 2605568
PID: 1272 ( 664) svchost.exe
size: 22016
PID: 1428 ( 664) svchost.exe
size: 22016
PID: 1676 ( 664) spoolsv.exe
size: 124928
PID: 1700 ( 664) avguard.exe
PID: 1712 ( 664) svchost.exe
size: 22016
PID: 2028 (1112) taskeng.exe
size: 166400
PID: 432 ( 664) sched.exe
PID: 504 ( 664) AOLacsd.exe
PID: 572 ( 664) avesvc.exe
PID: 768 ( 664) svchost.exe
size: 22016
PID: 1100 ( 664) NBService.exe
PID: 792 ( 664) svchost.exe
size: 22016
PID: 2064 ( 664) IoctlSvc.exe
size: 81920
PID: 2076 ( 664) svchost.exe
size: 22016
PID: 2088 ( 664) svchost.exe
size: 22016
PID: 2108 ( 664) PSIService.exe
size: 174656
PID: 2160 ( 664) svchost.exe
size: 22016
PID: 2224 ( 664) TestHandler.exe
PID: 2248 ( 664) svchost.exe
size: 22016
PID: 2284 ( 664) SearchIndexer.exe
size: 287744
PID: 2424 ( 664) SDWinSec.exe
PID: 2520 (1048) WUDFHost.exe
size: 144384
PID: 2752 ( 664) avmailc.exe
PID: 2560 ( 664) wmpnetwk.exe
PID: 5288 ( 664) usnsvc.exe
PID: 5824 (9676) regedit.exe
size: 134656
PID: 7732 (9676) regedit.exe
size: 134656
PID: 6468 (9676) regedit.exe
size: 134656
PID: 5528 (9676) regedit.exe
size: 134656
PID: 7924 (9676) regedit.exe
size: 134656
PID: 5248 (9676) regedit.exe
size: 134656
PID: 8540 (9676) regedit.exe
size: 134656
PID: 2152 (9676) regedit.exe
size: 134656
PID: 9856 (9676) regedit.exe
size: 134656
PID: 4244 (9676) regedit.exe
size: 134656
PID: 10040 (9676) regedit.exe
size: 134656
PID: 6336 (9676) regedit.exe
size: 134656
PID: 1936 (9676) regedit.exe
size: 134656
PID: 9084 (9676) regedit.exe
size: 134656
PID: 7696 (9676) regedit.exe
size: 134656
PID: 9888 (4480) C:\Windows\System32\conime.exe
size: 68608
MD5: 05CB3DA78A4BBD9B799A5957F9D101CC
PID: 10652 (6420) MpCmdRun.exe
PID: 6560 (11284) mfpmp.exe
size: 24576
PID: 11768 (2284) SearchProtocolHost.exe
size: 204288
PID: 10680 (2284) SearchFilterHost.exe
size: 76288
PID: 7076 ( 828) C:\Windows\system32\DllHost.exe
size: 7168
MD5: BE01E566D1F569AAB32D0335613E1EEA
So der andere teil sieht ziemlich langweilig aus ( kommt mir fast so vor als kommt immer das gleiche ). Hoffe ihr könnt damit etwas anfangen Mfg. derritter224 |
|
06.06.2008, 01:47
| #10 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! Hi melde mich zurück! Hier der log von combofix. Code:
ATTFilter ComboFix 08-06-05.3 - Robin 2008-06-06 2:37:16.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1154 [GMT 2:00]
ausgeführt von:: C:\Users\Robin\Documents\Desktop\~Dateien~ 01\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.
((((((((((((((((((((((( Dateien erstellt von 2008-05-06 bis 2008-06-06 ))))))))))))))))))))))))))))))
.
2008-06-05 11:10 . 2008-06-05 11:10 <DIR> d-------- C:\Users\Robin\Music
2008-06-04 04:17 . 2008-06-04 04:17 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-06-02 19:18 . 2008-06-02 19:18 <DIR> d-------- C:\Users\Robin\AppData\Roaming\Malwarebytes
2008-06-02 19:18 . 2008-06-02 19:18 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-06-02 19:18 . 2008-06-02 19:18 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-06-02 19:18 . 2008-06-02 19:18 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-02 19:18 . 2008-05-30 01:06 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-02 19:18 . 2008-05-30 01:06 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-05-28 07:37 . 2008-05-28 21:00 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-05-28 07:37 . 2008-05-28 21:00 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-05-28 07:37 . 2008-05-28 07:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-28 03:22 . 2008-03-08 02:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 03:22 . 2008-03-08 06:30 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-05-22 23:19 . 2008-05-31 17:38 <DIR> d-------- C:\Users\Robin\Foto's von Uns robin un malin
2008-05-20 23:06 . 2008-05-20 23:06 <DIR> d-------- C:\Users\Simone\AppData\Roaming\Nero
2008-05-19 17:22 . 2008-05-19 17:22 <DIR> d-------- C:\1169651469715
2008-05-19 15:17 . 2008-05-19 15:17 <DIR> d-------- C:\skin
2008-05-13 10:40 . 2008-05-13 10:40 43,520 --a------ C:\Windows\System32\drivers\fetnd6v.sys
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 20:36 --------- d-----w C:\Users\Robin\AppData\Roaming\SlimBrowser
2008-06-05 19:41 --------- d-----w C:\Program Files\ICQLite
2008-06-04 02:09 6,686 --sha-w C:\Windows\System32\KGyGaAvL.sys
2008-06-01 23:54 --------- d-----w C:\Users\Robin\AppData\Roaming\LimeWire
2008-05-14 01:01 --------- d-----w C:\Program Files\Windows Mail
2008-04-29 00:09 --------- d-----w C:\Program Files\NeroInstall.bak
2008-04-29 00:08 --------- d-----w C:\Users\Robin\AppData\Roaming\Nero
2008-04-29 00:07 --------- d-----w C:\Program Files\Common Files\Nero
2008-04-29 00:03 --------- d-----w C:\ProgramData\Nero
2008-04-29 00:03 --------- d-----w C:\Program Files\Nero
2008-04-28 23:47 716,272 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-04-28 23:21 --------- d-----w C:\Program Files\Common Files\Ahead
2008-04-19 00:37 --------- d-----w C:\Users\Robin\AppData\Roaming\Skype
2008-04-19 00:09 --------- d-----w C:\Users\Robin\AppData\Roaming\skypePM
2008-04-14 19:20 --------- d-----w C:\Users\Simone\AppData\Roaming\ICQLite
2008-04-11 21:46 --------- d-----w C:\Users\Simone\AppData\Roaming\SlimBrowser
2008-03-25 14:28 170,790 ----a-w C:\Windows\Photo Pos Pro Uninstaller.exe
2008-03-08 04:30 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-03-08 04:30 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-03-08 04:15 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-03-08 04:15 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-03-08 00:15 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-02-16 20:19 32 ----a-w C:\Users\All Users\ezsid.dat
2008-02-16 20:19 32 ----a-w C:\ProgramData\ezsid.dat
2007-10-18 11:42 174 --sha-w C:\Program Files\desktop.ini
2008-02-05 01:01 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-02-05 01:01 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-02-05 01:01 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
------- Sigcheck -------
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86}]
2007-10-16 20:58 1923584 --a------ C:\PROGRA~1\PHOTOP~2\PHOTOP~1.DLL
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86}"= "C:\PROGRA~1\PHOTOP~2\PHOTOP~1.DLL" [2007-10-16 20:58 1923584]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9f9d-3befcfbe6e86}]
[HKEY_CLASSES_ROOT\photoposcomtbr.PHOTOPOSCOMTBR]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{A057A204-BACC-4D26-9F9D-3BEFCFBE6E86}"= C:\PROGRA~1\PHOTOP~2\PHOTOP~1.DLL [2007-10-16 20:58 1923584]
[HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9f9d-3befcfbe6e86}]
[HKEY_CLASSES_ROOT\photoposcomtbr.PHOTOPOSCOMTBR]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 11:06 4669440 C:\Windows\RtHDVCpl.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"QuickFinder Scheduler"="c:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 23:21 83568]
"recinfo818"="c:\RecInfo\RecInfo.exe" [2007-09-14 14:53 2768896]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Premium\avgnt.exe" [2008-04-18 23:29 262401]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 02:03 284184]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2006-11-15 22:58 746520]
"HostManager"="C:\Program Files\Common Files\AOL\1196511391\ee\AOLSoftware.exe" [2006-11-14 15:47 50736]
"ICQ Lite"="C:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 12:15 3144800]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 22:52 49152]
"LVCOMSX"="C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-15 23:01 244512]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-06-01 17:46 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-06-01 17:46 8429568]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-06-01 17:46 81920]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-02 21:08 95504]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 13:00 531272]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 22:40:10 210520]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D86A317C-3F5C-4D51-BF42-5BCC9D625A3D}"= UDP:C:\Program Files\AOL\RC\regClient.exe:AOL
"{C598532E-C465-44FE-8EBE-40ED884DF64C}"= TCP:C:\Program Files\AOL\RC\regClient.exe:AOL
"{AD336417-C6E0-4FD4-B38B-505D11D70B48}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL Optimized Dial-In
"{349EB6E8-D73A-4EB9-9235-A7F707F5216B}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:AOL Optimized Dial-In
"{332961EE-5B38-4B5C-8D73-9D9B71456F36}"= UDP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL Optimized Dial-In
"{286CBB4E-8606-4EA7-9211-3FB107C5DAF1}"= TCP:C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:AOL Optimized Dial-In
"{95645749-FE19-40EB-8ABE-045BD9CC5C2A}"= UDP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{14A685C3-5896-4DEA-A815-215116CD5FD4}"= TCP:C:\Program Files\AOL 9.0 VR\waol.exe:AOL
"{21C238F9-7085-41BB-AC03-11296C85F6ED}"= UDP:C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{397F67DD-FE4A-41ED-BB44-AC4A343A567B}"= TCP:C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{AF842002-A087-444E-958A-B151EA526569}"= UDP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{74928309-06F4-4B44-99F2-497B41F3EA11}"= TCP:C:\Program Files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{74EA2A04-F334-40A3-9758-34E8BB4D53C1}"= UDP:C:\Program Files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{A1C76E84-AC66-4F73-867B-16B5CA2E4071}"= TCP:C:\Program Files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{17EA594F-C9E7-473F-9FB5-D916465D2900}"= UDP:0:LocalSubnet:LocalSubnet:Magix UPnP Media Server
"{F6CAAFFF-65E7-402F-8980-C24363E4D4B5}"= Disabled:UDP:2869:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (TCP)
"{B990A069-3BEC-4593-9040-1660DB09792C}"= Disabled:TCP:1900:LocalSubnet:LocalSubnet:Microsoft UPnP-Port (UDP)
"{F9E97A71-04CD-4595-8974-4E23CE809685}"= UDP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service
"{5F76047D-3936-42E4-BC1B-FE03C9958F99}"= TCP:C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe:Magix UPnP Service
"TCP Query User{BEA6A681-9643-461D-8DA2-1FDC218B534C}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{96518DC8-FFE9-4428-970A-1596317CF650}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary
"{8AF83DFB-8495-48D1-8E8A-47D6AFB07FCE}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{D83D8DF6-0EC6-4D80-A69A-9835C5EB35E2}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{D62CD985-5AA1-41F7-9241-E9C26C8B14ED}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= UDP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare
"UDP Query User{5FE92877-9645-40A5-B5B0-D028A1B92615}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= TCP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare
"TCP Query User{0FEBE79B-F74E-4E1F-ACE2-D0E24459F113}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{DCD86830-91A2-49FB-B474-35D5F84604C3}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"{CF635CC3-D5F4-41E7-B00C-9351ECC45882}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{491B6B5A-2995-4024-BA8B-32F9428D4616}C:\\program files\\kazaa lite\\clean.kmd"= UDP:C:\program files\kazaa lite\clean.kmd:clean.kmd
"UDP Query User{CC6002FB-D933-46F3-92C3-160FFA3A62DE}C:\\program files\\kazaa lite\\clean.kmd"= TCP:C:\program files\kazaa lite\clean.kmd:clean.kmd
"{4FA9BAEE-5A75-49FD-93C6-4C7E96C2C09A}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{8841B9FC-82BF-4EB4-B92B-7F60160419C8}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E1600004-8AE1-4657-870D-F26E8BD5F093}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{4D4162F4-E9C6-4868-A790-6724C97FDBDD}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{76BFB8D1-E176-4459-92C3-2218AFABEE2E}C:\\program files\\icqlite\\icqlite.exe"= Disabled:UDP:C:\program files\icqlite\icqlite.exe:ICQLite
"UDP Query User{8F0305DB-3B70-482F-A557-CF2FA6027B71}C:\\program files\\icqlite\\icqlite.exe"= Disabled:TCP:C:\program files\icqlite\icqlite.exe:ICQLite
"{160A4D52-0AD8-47AC-B166-78454DFCF2CC}"= UDP:C:\Program Files\ShareazaPlus\ShareazaPlus.exe:ShareazaPlus
"{E1F6B8B6-7BF1-4639-9A12-0A40A7D10AD2}"= TCP:C:\Program Files\ShareazaPlus\ShareazaPlus.exe:ShareazaPlus
"TCP Query User{AA24E98E-584F-4AA9-8176-B451C6EB11A3}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{56CBFEB8-809D-4FA5-8C2C-C42468BB0167}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"TCP Query User{7BDC95D2-2741-4ED0-851D-477D737521B3}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= UDP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
"UDP Query User{8DCCFFE4-24F4-424A-B99D-BC527F6DE0BB}C:\\program files\\common files\\nero\\nero web\\setupx.exe"= TCP:C:\program files\common files\nero\nero web\setupx.exe:Nero Installer
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 ViBus;ViBus;C:\Windows\system32\DRIVERS\ViBus.sys [2007-03-26 15:26]
R0 ViPrt;VIA SATA IDE Device Driver;C:\Windows\system32\DRIVERS\ViPrt.sys [2007-03-26 15:26]
R2 AntiVirMailService;AntiVir PersonalEdition Premium MailGuard;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avmailc.exe" [2008-05-09 19:32]
R2 AVEService;AntiVir PersonalEdition Premium MailGuard Hilfsdienst;"C:\Program Files\Avira\AntiVir PersonalEdition Premium\avesvc.exe" [2008-04-18 23:29]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 11:43]
R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 10:52]
R3 FETND6V;VIA Rhine Family Fast Ethernet Adapter Driver;C:\Windows\system32\DRIVERS\fetnd6v.sys [2008-05-13 10:40]
S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\Windows\system32\DRIVERS\fetnd5bv.sys [2008-01-02 03:12]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]
S3 UPnPService;UPnPService;C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [2006-12-14 17:00]
S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-07-02 17:37]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
*Newly Created Service* - CATCHME
.
Inhalt des "geplante Tasks" Ordners
"2008-06-05 08:50:12 C:\Windows\Tasks\User_Feed_Synchronization-{E361EA6E-438A-4109-9CB2-B11E92492BBD}.job"
- C:\Windows\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 02:39:32
Windows 6.0.6000 NTFS
Scanne versteckte Prozesse...
C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe [26176] 0x85977BC0
Scanne versteckte Autostart Einträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
Zeit der Fertigstellung: 2008-06-06 2:41:02
ComboFix-quarantined-files.txt 2008-06-06 00:40:22
19 Verzeichnis(se), 152,050,982,912 Bytes frei
27 Verzeichnis(se), 152,086,097,920 Bytes frei
179 --- E O F --- 2008-06-04 02:17:37
Mfg derritter224  |
|
06.06.2008, 23:40
| #11 |
| | HILFE, wenn ich etwas anklicke geht es nicht auf!! bitte helft mir es spinnt immernoch ... |
|
| Themen zu HILFE, wenn ich etwas anklicke geht es nicht auf!! |
| adobe, anfang, avg, avira, bho, defender, dll, explorer, fast start, g data, gservice, heulen, highjackthis, hijack, hijackthis, hängt, internet, internet explorer, langsam, logfile, magix, pdf, problem, programdata, programm, rundll, system, urlsearchhook, virus, vista, windows, windows defender, windows sidebar, wurm |
Hybrid-Darstellung
