Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Hijacklog (https://www.trojaner-board.de/18289-hijacklog.html)

EGGI 26.05.2005 15:04

Hijacklog
 
Hallo,
ich habe mich misher mit dem Thema sehr wenig beschäftigt und möchte euch bitten mein log zu checken. Ich habe u.a. das Problem, dass die Startseite meines IE sich immer auf "freshvideogals" ändert.
Vielen Dank!

Logfile of HijackThis v1.99.1
Scan saved at 15:38:45, on 26.05.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programme\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://freshvideogals.com/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://freshvideogals.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://freshvideogals.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://freshvideogals.com/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://freshvideogals.com/search/small.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://freshvideogals.com/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://freshvideogals.com/search/small.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://freshvideogals.com/search/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {FFCC8BDB-136C-4A1B-99B5-5DD0A0EF1564} - C:\WINDOWS\System32\imjhde.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdobeFonts] C:\WINDOWS\Fonts\fonts.hta
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [YAW starten] "C:\Programme\YAW 3.5\yawguard.exe"
O4 - Global Startup: Erinnerungen für Microsoft Works-Kalender.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O4 - Global Startup: Quicken 2005 Zahlungserinnerung.lnk = C:\Programme\Quicken2005\billmind.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing) (HKCU)
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/DE/install.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/03da3f2158db6c2...dxIE601_de.cab
O18 - Filter: text/html - {389F3064-3C89-49A6-B329-BADF47ED7739} - C:\WINDOWS\System32\imjhde.dll
O18 - Filter: text/plain - {389F3064-3C89-49A6-B329-BADF47ED7739} - C:\WINDOWS\System32\imjhde.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe

Rene-gad 26.05.2005 15:13

@EGGI
Bitte alle Links im Log deaktivieren (z.B. h**p statt http)
Zitat:

ich habe mich misher mit dem Thema sehr wenig beschäftigt
Das merkt man ;).
Zitat:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
SP2 fehlt komplett

Anleitung zum HJT durcharbeiten
Einträge mit HJT fixen
Zitat:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://freshvideogals.com/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://freshvideogals.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://freshvideogals.com/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://freshvideogals.com/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = h**p://freshvideogals.com/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://freshvideogals.com/search/small.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = h**p://freshvideogals.com/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://freshvideogals.com/search/small.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = h**p://freshvideogals.com/search/

O2 - BHO: (no name) - {FFCC8BDB-136C-4A1B-99B5-5DD0A0EF1564} - C:\WINDOWS\System32\imjhde.dll (file missing)

O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing) (HKCU)
O18 - Filter: text/html - {389F3064-3C89-49A6-B329-BADF47ED7739} - C:\WINDOWS\System32\imjhde.dll
O18 - Filter: text/plain - {389F3064-3C89-49A6-B329-BADF47ED7739} - C:\WINDOWS\System32\imjhde.dll
Dateien (falls vorhanden) im abgesicherten Modus lsöchen
Zitat:

C:\WINDOWS\System32\imjhde.dll
C:\WINDOWS\web\related.htm
C:\WINDOWS\System32\crtv2_32.dll
BTW: Projekt YAW3.5 ist geschloßen, es gibt kein Support und keine Updates => Programm deinstallieren.


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:28 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131