Hallo Trojaner-board!
Ich habe seit einer Woche das Problem das beim Start von meinem PC unter Prozesse im Windows Task-Manager die firefox.exe 4 mal geöffnet ist obwohl Firefox aus ist!
Wenn ich über den Windows Task-Manager die Prozesse schließe öffnen sie automatisch erneut!
Das Problem kann ich mit der rkill.exe vorübergehend lösen aber das ist keine dauerhafte Lösung nur so lang bis ich einen PC neustart gemacht habe.
Heute gegen 14:38 hat sich dann ein "Remote-Chat" geöffnet wo drin stand: "Dreh mal bitte deine Cam auf dich
".
Ich war vorerst sehr erschrocken und habe sofort die rkill.exe wieder ausgeführt um den Prozess beenden zu können da er sonst ja immer wieder an ging!
Ich hoffe man kann mir helfen!
Den PC neu aufsetzen möchte ich übrigens nicht da ich keine externe Festplatte oder anderes habe wo ich meine Daten etc. speichern kann.
Hier mal dieses
HijackThis Log:
Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29:31, on 17.01.2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
H:\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
H:\Avira\AntiVir Desktop\avguard.exe
H:\Avira\AntiVir Desktop\avshadow.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
H:\Java\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Norton\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\PnkBstrA.exe
D:\Norton\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
H:\TortoiseSVN\bin\TSVNCache.exe
H:\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Steam\steam.exe
C:\Programme\DNA\btdna.exe
C:\Programme\Skype\Phone\Skype.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\Explorer.exe
F:\Mozilla Firefox\firefox.exe
F:\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\notepad.exe
H:\Programme\ICQ7.2\ICQ.exe
C:\WINDOWS\system32\cmd.exe
H:\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: Winload Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWin2.dll
R3 - URLSearchHook: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Programme\uTorrentBar\tbuTo1.dll
R3 - URLSearchHook: OLE (Part 1 of 5) - - (no file)
R3 - URLSearchHook: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
F2 - REG:system.ini: Shell=Explorer.exe
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin1.dll
O2 - BHO: Winload Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWin2.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Programme\uTorrentBar\tbuTo1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Java\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - H:\Java\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file)
O3 - Toolbar: (no name) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - (no file)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Programme\Styler\TB\StylerTB.dll
O3 - Toolbar: Winload Toolbar - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWin2.dll
O3 - Toolbar: uTorrentBar Toolbar - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Programme\uTorrentBar\tbuTo1.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin1.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVDV.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "H:\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "H:\Programme\Logitech\Logitech WebCam Software\LWS.exe" /hide
O4 - HKLM\..\Run: [HKLM] C:\WINDOWS\system32\install\svchost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "D:\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Programme\DNA\btdna.exe"
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AutoStartNPSAgent] H:\Programme\NPSAgent.exe
O4 - HKCU\..\Run: [HKCU] C:\WINDOWS\system32\install\svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [Audio HD Driver] C:\Dokumente und Einstellungen\Uli\Anwendungsdaten\jY1Vcvmu9jy.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\WINDOWS\system32\install\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Uli\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\HOMEPA~1\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - H:\Programme\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - H:\Programme\ICQ7.2\ICQ.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\ICQ\ICQ6.5\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - G:\ICQ\ICQ6.5\ICQ.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O15 - Trusted Zone: hxxp://toolbar.imageshack.us
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - (no file)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - H:\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - H:\Avira\AntiVir Desktop\avguard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - H:\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programme\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - H:\Java\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NBService - Unknown owner - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - D:\Norton\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Speed Disk service - Symantec Corporation - D:\Norton\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe
O24 - Desktop Component 0: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Coastal_Refr_Sher.jpg
O24 - Desktop Component 1: (no name) - hxxp://www.fantom-xp.com/wallpapers/42/Tropical_-_Coast.jpg
O24 - Desktop Component 10: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Lighthouse.jpg
O24 - Desktop Component 11: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Hidden_Pool_Colorado_Plateau_Utah.jpg
O24 - Desktop Component 12: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/flower_-_Water_and_Roses.jpg
O24 - Desktop Component 13: (no name) - hxxp://www.fantom-xp.com/wallpapers/12i/Tropic_Night.jpg
O24 - Desktop Component 14: (no name) - hxxp://www.fantom-xp.com/wallpapers/12i/Sky_Splash.jpg
O24 - Desktop Component 15: (no name) - hxxp://www.fantom-xp.com/wallpapers/42/Stormy_Weather.jpg
O24 - Desktop Component 2: (no name) - hxxp://www.fantom-xp.com/wallpapers/42/Autumn_Cognac_-_Region.jpg
O24 - Desktop Component 3: (no name) - hxxp://www.fantom-xp.com/wallpapers/42/Prabang_Laos.jpg
O24 - Desktop Component 4: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Palm_coast.jpg
O24 - Desktop Component 5: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Hawaii_-_Na_Pali_Coast%2C_Kauai.jpg
O24 - Desktop Component 6: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Clean_Sky.jpg
O24 - Desktop Component 7: (no name) - hxxp://www.fantom-xp.com/wallpapers/42/Coastal_Dreams_-_Hawaii.jpg
O24 - Desktop Component 8: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Desert_Strike.jpg
O24 - Desktop Component 9: (no name) - hxxp://www.fantom-xp.com/wallpapers/42i/Sugarloaf_Sunset.jpg
--
End of file - 11044 bytes
|
17.01.2011, 16:31
Baum-Darstellung