|
ESCAN LOGFILE, bitte um hilfe Hallo nochmals zusammen, auf meinen ersten Thraed bekam ich keine Antwort, habe nun einen Scan mit ESCAN gemacht. Hier der Logfile: Sat Jan 07 19:40:38 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 19:40:39 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 19:40:40 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 19:40:44 2006 => Offending Folder found: C:\Dokumente und Einstellungen\test\Eigene Dateien\harry potter ii\save Sat Jan 07 19:40:44 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Jan 07 19:40:57 2006 => Offending Folder found: C:\Dokumente und Einstellungen\test\Eigene Dateien\harry potter ii\save Sat Jan 07 19:40:57 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Jan 07 19:41:00 2006 => ***** Scanning Registry for errors created because of Adware/Spyware ***** Sat Jan 07 19:41:02 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "d:\Programme\InterVideo\Common\Bin\IVIPromotion.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:06 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\AOL 8.0\Aol.hlp". Action Taken: No Action Taken. Sat Jan 07 19:41:06 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\AOL 8.0\Aol.cnt". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe" refers to invalid object "C:\WINDOWS\System32\cmmgr32.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Creator3.exe" refers to invalid object "C:\Programme\LEGO Media\LEGO Creator Harry Potter\Creator3.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Easy-WebPrint" refers to invalid object "C:\Programme\Canon\Easy-WebPrint\Easy-WebPrint". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\EpSCTWeb.exe" refers to invalid object "C:\Programme\EPSON\ScanToWeb\EpSCTWeb.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\EPSON PhotoQuicker3.5.exe" refers to invalid object "C:\Programme\EPSON\EPSON PhotoQuicker3.5\EPSON PhotoQuicker3.5.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\Roxioscan.exe" refers to invalid object "C:\Programme\Gemeinsame Dateien\Roxio Shared\Support\Roxioscan.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:07 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\setup.exe" refers to invalid object "C:\Programme\REALTEK Semiconductor Corp.\Realtek RTL8139/810x Fast Ethernet NIC Driver Setup\setup.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".BTW". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".cst". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".cxt". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".index". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".LDF". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".plf". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".prx". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rar". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".SPW". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".usa". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".VCD". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "America Online de". Action Taken: No Action Taken. Sat Jan 07 19:41:16 2006 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "xp-AntiSpy". Action Taken: No Action Taken. Sat Jan 07 19:41:17 2006 => Entry "HKCR\CLSID\{2B26AEBA-25CB-419C-87FB-8880A77964F4}" refers to invalid object "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll". Action Taken: No Action Taken. Sat Jan 07 19:41:19 2006 => Entry "HKCR\CLSID\{86FC1FD1-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\mDxEmul.mom". Action Taken: No Action Taken. Sat Jan 07 19:41:19 2006 => Entry "HKCR\CLSID\{86FC1FD3-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\mDxEmul.mom". Action Taken: No Action Taken. Sat Jan 07 19:41:20 2006 => Entry "HKCR\CLSID\{B1EDCE8E-86A4-473a-8A36-54B322C3F618}" refers to invalid object "d:\Programme\Ulead Systems\Ulead PhotoImpact 8\wpe.dll". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\CLSID\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}" refers to invalid object "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\CLSID\{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" refers to invalid object "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\CLSID\{FACF11A2-5095-11D3-A9DE-00C0268E5C48}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\mDxEmul.mom". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{0CEBAFA2-A5F8-11D1-B76F-58BB04C10000}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{1257CD33-90D0-11D1-A197-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{143C9CF1-E3E7-11D1-A1D2-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{19362773-E965-11D1-A1F0-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{3937476C-846F-459C-BD47-75EC6B0834E4}" refers to invalid object "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{3E895E71-0C27-11D2-A212-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{67800A63-C222-11D1-A1B3-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:21 2006 => Entry "HKCR\TypeLib\{86FC1FC2-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\mDxEmul.mom". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\TypeLib\{9F3595E2-B5CC-11D1-B76F-58BB04C10000}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\TypeLib\{9FD46A24-F9E8-11D1-A204-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\TypeLib\{C8E100B3-6D59-11D1-A181-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\TypeLib\{FD6E3405-67CB-11D1-A17E-080009AB3411}" refers to invalid object "C:\DOKUME~1\test\LOKALE~1\Temp\ZipNrun.tmp\md8rntm.exe". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.acl" refers to invalid object "ACLFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.aw" refers to invalid object "AWFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.col" refers to invalid object "COLFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.det" refers to invalid object "DETFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.elm" refers to invalid object "ELMFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.ffa" refers to invalid object "FFAFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.ffl" refers to invalid object "FFLFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.fft" refers to invalid object "FFTFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.ffx" refers to invalid object "FFXFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.frg" refers to invalid object "Access.Fragment". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.gst" refers to invalid object "MSMap.Datainst.8". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.idc" refers to invalid object "idcfile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.ldb" refers to invalid object "Access.LockFile.9". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.lex" refers to invalid object "LEXFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.opc" refers to invalid object "OPCFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.pcb" refers to invalid object "PCBFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.pip" refers to invalid object "PIPFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.sll" refers to invalid object "SSLFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.stf" refers to invalid object "STFFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.tuw" refers to invalid object "TUWFile". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\.wll" refers to invalid object "Word.Addin.8". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken. Sat Jan 07 19:41:22 2006 => Entry "HKCR\Connection Manager Profile\shell\open\command" refers to invalid object "C:\WINDOWS\System32\CMMGR32.EXE "%1"". Action Taken: No Action Taken. Sat Jan 07 19:41:23 2006 => Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken. Sat Jan 07 19:41:23 2006 => Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken. Sat Jan 07 19:41:23 2006 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Sat Jan 07 19:41:23 2006 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Sat Jan 07 19:41:23 2006 => Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Sat Jan 07 19:41:24 2006 => Entry "HKCR\Ulead.VOE.1" refers to invalid object "{6C91BBFD-0781-4936-A3DC-10D60BA3294D} ". Action Taken: No Action Taken. Ich bitte um eure hilfe und danke im voraus für eure Antworten und Tipps. Gruß kitkatde |
Lade und update Ad-aware sowie Spybot S&D und lasse die Programme laufen. Mit Spybot immunisieren http://www.comsafe.de/download.html Installiere Clearprog, rufe es auf und setze den Haken bei alles löschen und dann Löschen drücken. http://www.clearprog.de/ Lade RegSeeker Sichern vor Löschen anhaken und nur die grünen Funde entfernen! Gehe mal in die Systemsteuerung->Software und entferne Dir unbekannte Programme. Lösche im Verzeichnis c:\bases_x die Datei mwav.log. Anschließend neuer escan und wieder das mit der find.bat erstellte Log posten. |
Hi, danke für deine schnelle Antwort. Habe alles so durchgeführt, hier der neue Log File von ESCAN: Sat Jan 07 22:19:07 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 22:19:07 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 22:19:07 2006 => System found infected with adware.toolbar.sbsoft.h Spyware/Adware ({08bec6aa-49fc-4379-3587-4b21e286c19e})! Action taken: No Action Taken. Sat Jan 07 22:19:07 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 22:19:07 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 22:19:08 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Sat Jan 07 22:19:12 2006 => Offending Folder found: C:\Dokumente und Einstellungen\test\Eigene Dateien\harry potter ii\save Sat Jan 07 22:19:12 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Jan 07 22:19:13 2006 => Offending Folder found: C:\Dokumente und Einstellungen\test\Eigene Dateien\harry potter ii\save Sat Jan 07 22:19:13 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken. Darüber hinaus meldet das Programm 81 Errors. Ich danke schon mal im voraus für deine Hilfe. Gruß kitkatde |
Lade Dir mal die 14-Tage-Version von Ewido, update sie: http://www.ewido.net/de/download/ Lasse Ewido das System scannen und bereinigen. Poste das Ergebnis des Scans mit ewido. Und dann nochmals: Lösche im Verzeichnis c:\bases_x die Datei mwav.log. Anschließend neuer escan und wieder das mit der find.bat erstellte Log posten |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 04:19 Uhr. |
Copyright ©2000-2024, Trojaner-Board