| |
| |||||||
Log-Analyse und Auswertung: Google leitet auf falsche Seiten weiter - hier mein HiJackThis logWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.06.2010, 13:04
| #1 |
| |  Google leitet auf falsche Seiten weiter - hier mein HiJackThis log Hallo, habe wie manch andere hier auch das Problem, dass wenn ich auf Google Links klicke, ich auf falschen Seiten herauskomme. Bin bereits mit CCleaner drüber gegangen. Hier erst mal der Bericht von Malwarebytes: (weiter unten ist der von HJT) Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4219
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
21.06.2010 13:30:52
mbam-log-2010-06-21 (13-30-52).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 136331
Laufzeit: 4 Minute(n), 49 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 4
Infizierte Dateiobjekte der Registrierung: 12
Infizierte Verzeichnisse: 1
Infizierte Dateien: 13
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijacker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\multimediaControls.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\926a3d6d-8b76-4a41-a4bb-190d05d3edca_40 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/ie6.html) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/search?q={searchTerms}) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\(default) (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/search?q=%s) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/ie6.html) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/search?q={searchTerms}) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\(default) (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com/search?q=%s) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchURL (Hijack.SearchPage) -> Bad: (h**p://windiwsfsearch.com) Good: (h**p://www.Google.com/) -> Quarantined and deleted successfully.
Infizierte Verzeichnisse:
C:\WINDOWS\system32\912525 (Trojan.BHO) -> Quarantined and deleted successfully.
Infizierte Dateien:
C:\Dokumente und Einstellungen\xxxx\Lokale Einstellungen\Temp\0.5553444350494555.exe (Trojan.Scar) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\xxxx\Lokale Einstellungen\Temp\ins11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\xxxx\Favoriten\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\xxxx\Eigene Dateien\My Documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myd.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\mym.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myp.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\myv.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Programme\Applications\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Antivirus Scan.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\All Users\Startmenü\Online Spyware Test.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\xxxx\Anwendungsdaten\926a3d6d-8b76-4a41-a4bb-190d05d3edca_40.avi (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:37:20, on 21.06.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\MagicTune Premium\MagicTuneEngine.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\Explorer.EXE C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\System32\svchost.exe C:\Programme\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\FreePDF_XP\fpassist.exe C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\Programme\MagicTune Premium\MagicTune.exe C:\Programme\MagicRotation\MagicPvt.exe C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\MagicTune Premium\GammaTray.exe C:\Programme\SEC\Natural Color Pro\NCProTray.exe C:\PVSW\bin\w3dbsmgr.exe C:\Programme\Windows Desktop Search\WindowsSearch.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\xxxxxxxxx\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JD2TV3RZ\HiJackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://aolwebmail.aol.de/landing-page R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://renewalcenter.symantec.com/storefront/user/home.jsp?NOS=kjhawazbOPIPChxtwAiBKDsNTNUCtAKaygiCv4RZDQBDvStB8mfCsrINTDwijrTCF5LpTgFlCBe4zHFH834QXHFM6%2F2ybNAvVAi6ITiDIjDdGQswC2zFMN2GDWRmzVjCC1pbS%2B2GCcSCT0CCs8eEDNNeGRgBECA%2BvlHFH834QXHFM6&SASSERVER=lcsitemain.symantec.com&TRANSID=%2F10097711%2FC6bb746DB858FD14E066B&GUID=786D05A5A0F14055BCB6543C451E5F7F&SSLT=2&GER&DEU&GE&oslang=iso:GER&oslocale=iso:DEU&vendid=003&vendtag=0&epid=786D05A5A0F14055BCB6543C451E5F7F O1 - Hosts: 84.16.244.54 w*w.google.com O1 - Hosts: 84.16.244.54 us.search.yahoo.com O1 - Hosts: 84.16.244.54 uk.search.yahoo.com O1 - Hosts: 84.16.244.54 search.yahoo.com O1 - Hosts: 84.16.244.54 w*w.google.com.br O1 - Hosts: 84.16.244.54 w*w.google.it O1 - Hosts: 84.16.244.54 w*w.google.es O1 - Hosts: 84.16.244.54 w*w.google.co.jp O1 - Hosts: 84.16.244.54 w*w.google.com.mx O1 - Hosts: 84.16.244.54 w*w.google.ca O1 - Hosts: 84.16.244.54 w*w.google.com.au O1 - Hosts: 84.16.244.54 w*w.google.nl O1 - Hosts: 84.16.244.54 w*w.google.co.za O1 - Hosts: 84.16.244.54 w*w.google.be O1 - Hosts: 84.16.244.54 w*w.google.gr O1 - Hosts: 84.16.244.54 w*w.google.at O1 - Hosts: 84.16.244.54 w*w.google.se O1 - Hosts: 84.16.244.54 w*w.google.ch O1 - Hosts: 84.16.244.54 w*w.google.pt O1 - Hosts: 84.16.244.54 w*w.google.dk O1 - Hosts: 84.16.244.54 w*w.google.fi O1 - Hosts: 84.16.244.54 w*w.google.ie O1 - Hosts: 84.16.244.54 w*w.google.no O1 - Hosts: 84.16.244.54 w*w.google.de O1 - Hosts: 84.16.244.54 w*w.google.fr O1 - Hosts: 84.16.244.54 w*w.google.co.uk O1 - Hosts: 84.16.244.54 w*w.bing.com O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\IPSBHO.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [CamMonitor] C:\Programme\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe O4 - HKLM\..\Run: [MagicRotation] C:\Programme\MagicRotation\MagicPvt.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NortonUtilities] C:\Programme\Norton Utilities 14\nu.exe /H O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: GammaTray.lnk = ? O4 - Global Startup: NCProTray.lnk = ? O4 - Global Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\bin\w3dbsmgr.exe O4 - Global Startup: Windows Search.lnk = C:\Programme\Windows Desktop Search\WindowsSearch.exe O4 - Global Startup: Zahlungserinnerung.lnk = C:\Profi cash\wzed.exe O4 - Global AltStartup: GammaTray.lnk = ? O4 - Global AltStartup: NCProTray.lnk = ? O4 - Global AltStartup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\bin\w3dbsmgr.exe O4 - Global AltStartup: Windows Search.lnk = C:\Programme\Windows Desktop Search\WindowsSearch.exe O4 - Global AltStartup: Zahlungserinnerung.lnk = C:\Profi cash\wzed.exe O4 - Global User AltStartup: GammaTray.lnk = ? O4 - Global User AltStartup: NCProTray.lnk = ? O4 - Global User AltStartup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\bin\w3dbsmgr.exe O4 - Global User AltStartup: Windows Search.lnk = C:\Programme\Windows Desktop Search\WindowsSearch.exe O4 - Global User AltStartup: Zahlungserinnerung.lnk = C:\Profi cash\wzed.exe O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O15 - Trusted Zone: h**p://navigate.aol.de O15 - Trusted Zone: h**p://*.aol.de O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - h**p://dev.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class) - h**p://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan-canvasx.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1212647954218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\coIEPlg.dll O23 - Service: Automatisches LiveUpdate - Scheduler - Unknown owner - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: FABS - Helping agent for MAGIX media database (Fabs) - MAGIX AG - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\FABS.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\Gemeinsame Dateien\MAGIX Services\Database\bin\fbserver.exe O23 - Service: Google Update Service (gupdate1c9c8aded9d4818) (gupdate1c9c8aded9d4818) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: MagicTuneEngine - Unknown owner - C:\Programme\MagicTune Premium\MagicTuneEngine.exe O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Norton Internet Security - Symantec Corporation - C:\Programme\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe -- End of file - 10833 bytes Wäre echt super dankbar für Hilfe! Falls noch irgendetwas benötigt wird bitte sagen. MFG |
|
21.06.2010, 13:11
| #2 |
| /// Malware-holic   | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log hallo,ootl:
__________________Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "run Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt falls die zu groß sind, bitte aufteilen |
|
22.06.2010, 10:50
| #3 |
| | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log Hi, also hier die zwei OTL Reports:
__________________OTL.txt Code:
ATTFilter OTL Logfile: [CODE] OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 22.06.2010 11:25:53 - Run 1
OTL by OldTimer - Version 3.2.6.1 Folder = C:\Dokumente und Einstellungen\xxx\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 195,31 Gb Total Space | 165,82 Gb Free Space | 84,90% Space Free | Partition Type: NTFS
Drive D: | 270,45 Gb Total Space | 263,95 Gb Free Space | 97,59% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive M: | 154,36 Gb Total Space | 145,16 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive N: | 154,36 Gb Total Space | 145,16 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive P: | 154,36 Gb Total Space | 145,16 Gb Free Space | 94,03% Space Free | Partition Type: NTFS
Drive U: | 482,51 Mb Total Space | 482,00 Mb Free Space | 99,89% Space Free | Partition Type: FAT32
Computer Name: xxxx
Current User Name: xxx
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\MagicTune Premium\MagicTune.exe" = C:\Programme\MagicTune Premium\MagicTune.exe:*:Enabled:MagicTune -- (SEC)
"C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe" = C:\Programme\Gemeinsame Dateien\Ahead\Nero Web\SetupX.exe:*:Enabled:Nero ProductSetup -- (Nero AG)
"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\Nero Web\SetupXu.exe" = C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\Nero Web\SetupXu.exe:*:Enabled:Nero ProductSetup -- File not found
"C:\PVSW\bin\w3dbsmgr.exe" = C:\PVSW\bin\w3dbsmgr.exe:*:Enabled:Database Service Manager -- ()
"C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\DOKUME~1\FRIEDR~1\LOKALE~1\Temp\0.9426957749426517.exe" = [String data over 1000 bytes]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0EFC334E-0BFE-4387-8E67-A0DAA54D998D}" = AutoRotation Premium
"{1A91342B-042E-46B3-AD06-897FF1BAC8F4}" = OKI C3300_3400 Status Monitor
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{38ADB9A6-798C-11D6-A855-00105A80791C}" = OKI Network Extension
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMB36X Raid Configurer
"{48AB06FF-059D-43DE-ACC1-15920D5A7FF2}" = JRE 1.4.2
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5721A8EA-A30F-4F66-9046-3F40C43AE1DC}" = Driver Detective
"{5D729200-F340-4A74-A1E9-32387CDC63EF}" = OKI Color Correct Utility
"{5F045A94-B4B0-4F24-BE71-8491B7121CB0}" = Auerswald COMtools 2.2.69
"{65B2B4C4-A67F-485E-9A6B-E72E07AB8DFF}" = Auerswald COMlist 2.4.36
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_SMALLBUSINESSR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{938996BF-AE93-451A-853C-91F16CF4333A}" = Auerswald COMfortel Melody 1.0.37
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A344F95E-E51A-450C-8F84-C940BF61903E}" = OKI Color Swatch-Dienstprogramm
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{AF37F9DE-0726-439E-BC10-43D9195394D0}" = Firebird SQL Server - MAGIX Edition
"{B256C380-AC47-4681-8342-7F42E4F0F434}" = JRE 1.6.1
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Speicher-Disc
"{BC3EAA6A-FA0A-4E88-87DE-A34D0DFF3FDF}" = HP Photo and Imaging 2.0 - Photosmart Cameras
"{C095AB64-EF16-4636-9A78-5E72C3DC3173}" = Auerswald COMset 2.6.29
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C43EE115-39FC-4FC4-9DAA-ACF527620298}" = Auerswald COMfortel Set 2.0.08
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D360A313-4656-4A1F-929A-243F668C12DA}" = Template Manager 3.0
"{D8C0330E-C815-4C6F-9BFD-0FD570155790}" = Pervasive.SQL 9 SP2 Workgroup for Windows (9.5)
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{F90D6825-8F1F-4E3A-9E42-A9C8A9DD1031}" = Nero 7 Essentials
"{FC2C7405-BC58-4E11-8F51-29671BEAC06B}" = Natural Color Pro
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"AFPL Ghostscript 8.54" = AFPL Ghostscript 8.54
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"ALDI Süd Foto Manager Free D" = ALDI Süd Foto Manager Free
"ALDI Süd Foto Service D" = ALDI Süd Foto Service
"Aldi Süd Fotoservice_is1" = Aldi Süd Fotoservice
"ALDI Süd Online Druck Service" = ALDI Süd Online Druck Service 4.6
"ALDI Süd Online Druck Service D" = ALDI Süd Online Druck Service
"Auerswald CAPI 2.0 Treiber" = Auerswald-CAPI-2.0-Treiber
"Auerswald UNI TSP Treiber" = Auerswald UNI TSP Treiber
"CCleaner" = CCleaner
"FileZilla Client" = FileZilla Client 3.3.1
"FreePDF_XP" = FreePDF XP (Remove only)
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"LIDL Fotoservice_is1" = LIDL Fotoservice
"Lidl-Fotos_is1" = Lidl-Fotos
"MAGIX Online Druck Service D" = MAGIX Online Druck Service
"MAGIX Screenshare D" = MAGIX Screenshare
"MAGIX Xtreme Web Designer 5 D" = MAGIX Xtreme Web Designer 5 5.0.1.10003 (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NIS" = Norton Internet Security
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Norton Utilities_is1" = Norton Utilities
"NVIDIA Drivers" = NVIDIA Drivers
"Pervasive System Analyzer" = Pervasive System Analyzer
"Profi cash" = Profi cash
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"SystemRequirementsLab" = System Requirements Lab
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 08.05.2010 03:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 04:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 05:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 06:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 07:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 08:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 09:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 10:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 11:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
Error - 08.05.2010 12:34:14 | Computer Name = xxxx | Source = Google Update | ID = 20
Description =
[ OSession Events ]
Error - 18.09.2008 04:56:00 | Computer Name = xxxx | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6308.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 209
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.08.2009 07:40:56 | Computer Name = xxxx | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.08.2009 07:41:02 | Computer Name = xxxx | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 2
seconds with 0 seconds of active time. This session ended with a crash.
Error - 04.08.2009 07:41:07 | Computer Name = xxxx | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 1
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 19.06.2010 06:21:42 | Computer Name = xxxx | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
Fehlers nicht gestartet: %%3
Error - 19.06.2010 06:29:17 | Computer Name = xxxx | Source = Service Control Manager | ID = 7034
Description = Dienst "MagicTuneEngine" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 21.06.2010 02:23:42 | Computer Name = xxxx | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
Fehlers nicht gestartet: %%3
Error - 21.06.2010 07:03:04 | Computer Name = xxxx | Source = Service Control Manager | ID = 7034
Description = Dienst "MagicTuneEngine" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 21.06.2010 07:06:02 | Computer Name = xxxx | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
Fehlers nicht gestartet: %%3
Error - 21.06.2010 07:31:34 | Computer Name = xxxx | Source = Service Control Manager | ID = 7034
Description = Dienst "MagicTuneEngine" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 21.06.2010 07:32:54 | Computer Name = xxxx | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
Error - 21.06.2010 07:34:19 | Computer Name = xxxx | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
Fehlers nicht gestartet: %%3
Error - 22.06.2010 02:15:12 | Computer Name = xxxx | Source = Service Control Manager | ID = 7034
Description = Dienst "MagicTuneEngine" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 22.06.2010 02:17:58 | Computer Name = xxxx | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Automatisches LiveUpdate - Scheduler" wurde aufgrund folgenden
Fehlers nicht gestartet: %%3
< End of report >
Hoffe ihr könnt was damit anfangen! MFG |
|
22.06.2010, 11:16
| #4 |
| /// Malware-holic | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log Fixen mit OTL • Starte bitte die OTL.exe. Vista-User mit Rechtsklick "als Administrator starten" • Kopiere nun das Folgende in die Textbox. :OTL PRC - N:\BWWIN32.exe () O36 - AppCertDlls: extrpbar - (C:\WINDOWS\system32\attruota.dll) - C:\WINDOWS\system32\attruota.dll () [2010.06.16 08:43:59 | 000,613,362 | ---- | M] () -- C:\Dokumente und Einstellungen\xxxx\Anwendungsdaten\mdbu.bin :Files N:\BWWIN32.exe C:\WINDOWS\system32\attruota.dll :HOSTS :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument dieses posten |
|
24.06.2010, 16:03
| #5 |
| | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log Hi, hier der Report: Code:
ATTFilter All processes killed
========== OTL ==========
No active process named BWWIN32.exe was found!
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\extrpbar:C:\WINDOWS\system32\attruota.dll deleted successfully.
C:\WINDOWS\system32\attruota.dll moved successfully.
C:\Dokumente und Einstellungen\xxxx\Anwendungsdaten\mdbu.bin moved successfully.
========== FILES ==========
N:\BWWIN32.exe moved successfully.
File\Folder C:\WINDOWS\system32\attruota.dll not found.
Error: Unable to interpret <:HOSTS> in the current context!
========== COMMANDS ==========
[EMPTYFLASH]
User: Administrator
->Flash cache emptied: 405 bytes
User: All Users
User: Default User
->Flash cache emptied: 41 bytes
User: xxxx
->Flash cache emptied: 2780 bytes
User: LocalService
->Flash cache emptied: 405 bytes
User: NetworkService
Total Flash Files Cleaned = 0,00 mb
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 739463276 bytes
->Temporary Internet Files folder emptied: 3065380 bytes
->Flash cache emptied: 0 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: xxxx
->Temp folder emptied: 185662838 bytes
->Temporary Internet Files folder emptied: 7193067 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 263337 bytes
->Flash cache emptied: 0 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2148906 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 89608222 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 980,00 mb
OTL by OldTimer - Version 3.2.6.1 log created on 06242010_165715
Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\JETE176.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_244.dat not found!
Registry entries deleted on Reboot...
|
|
24.06.2010, 16:16
| #6 |
| /// Malware-holic | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix |
|
25.06.2010, 16:22
| #7 |
| | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log Hier die logdatei von combofix: Code:
ATTFilter Combofix Logfile: |
|
25.06.2010, 16:35
| #8 |
| /// Malware-holic | Google leitet auf falsche Seiten weiter - hier mein HiJackThis log du willst doch weiterhin norton nutzen? warum hast du noch kein norton 2010 instaliert, bitte mach das und scanne dann damit deinen pc. |
|
| Themen zu Google leitet auf falsche Seiten weiter - hier mein HiJackThis log |
| adobe, antivirus, desktop, dll, einstellungen, explorer, falsche seite, google, gupdate, hijack, hijackthis, hkus\s-1-5-18, intrusion prevention, leitet, log, malwarebytes, microsoft, nvidia, plug-in, problem, programme, rundll, search.hijacker, searchscopes, security, seiten, software, spyware, super, system, temp, trojan.scar, windows xp |
