Win XP SP2 - Mein logfile prüfen
 

musste Win XP neu aufsetzen, weil CPU neu.
bei einem online scan erhielt ich hinweis, dass spyware vorhanden.
meine kenntnisse sind nicht ausreichend.
sehr ihr hier etwas verdächtiges?
DANKE


Logfile of HijackThis v1.99.1
Scan saved at 14:47:11, on 13.7.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Programme\Norton AntiVirus 2004 Prof -jul2006\navapsvc.exe
C:\Programme\Norton AntiVirus 2004 Prof -jul2006\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\Norton AntiVirus 2004 Prof -jul2006\SAVScan.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\LTSMMSG.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\ULi5287\ULi5287.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\SEC\MagicTune3.6_Client_pivot\GammaTray.exe
C:\Programme\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe
C:\Programme\SEC\Natural Color\NaturalColorLoad.exe
C:\Programme\Sony\VAIO Action Setup\VAServ.exe
C:\Programme\Hewlett-Packard\HP OfficeJet Series 500\bin\HPOVDX05.EXE
C:\Programme\T-DSL SpeedManager\TSMSvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\NMain.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\DOKUME~1\BESITZ~1.NAM\LOKALE~1\Temp\Temporäres Verzeichnis 3 für hijackthis_199.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.club-vaio.sony-europe.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus 2004 Prof -jul2006\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus 2004 Prof -jul2006\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ULiRaid] C:\Programme\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~3\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\\SmartDoctor.exe /start
O4 - HKCU\..\Run: [updateMgr] C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0 -reboot 1
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = C:\Programme\SEC\MagicTune3.6_Client_pivot\GammaTray.exe
O4 - Global Startup: HP OfficeJet Series 500-Start.lnk = C:\Programme\Hewlett-Packard\HP OfficeJet Series 500\Bin\HPOstr05.exe
O4 - Global Startup: MagicTune3.6.lnk = C:\Programme\SEC\MagicTune3.6_Client_pivot\MagicTuneTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: VAIO Action Setup (Server).lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus 2004 Prof -jul2006\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton AntiVirus 2004 Prof -jul2006\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus 2004 Prof -jul2006\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: T-DSL SpeedManager (TSMService) - T-Systems Business Services - C:\Programme\T-DSL SpeedManager\TSMSvc.exe

Hallo alexa_deVerräts du uns auch diese Hinweise oder wird dies ein Rätselspiel? :huepp:
Was kann man gewinnen? :D

Ich bin dabei :D
Ich sage mal wegen der Namensgebung des TE, das es sich um Alexa handelt.
Gewinn??


Grüße Wildone

scan mit asquare Hijackfree
hier ein ausschnitt

(Norton Antivirus und MS Tool zum Entferner böser...beide programme haben nichts gefunden)

Name: NvCplDaemon
Pfad: RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
Ort: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Gut: 4 - Böse: 2
Details Anzeigen Erfordert Beachtung!
Bitte Details mit lokalen Daten vergleichen
und/oder Recherche bei Google

Name: Alcmtr
Pfad: ALCMTR.EXE
Ort: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


Name: ccApp
Pfad: C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
Ort: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$statusgood$ Y ccApp ccApp.exe Part of Norton AntiVirus. Auto-protect and E-mail check will not function without this
$statusbad$ X ccApp [random filename] Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus
$statusbad$ X ccApp WMADZ.EXE Added by the RBOT-LJ WORM!
$statusbad$ X ccApp .EXE Added by the RBOT-LJ WORM!
$statusbad$ X ccApp gcasServ.exe Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name
$statusbad$ X Norton Auto-Protect ccApp.exe Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is "navapexe". This is also not the valid Norton AV file with the same filename
$statusgood$ Y ccApp ccApp.exe Part of Norton AntiVirus. Auto-protect and E-mail check will not function without this
$statusbad$ X ccApp [random filename] Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus
$statusbad$ X ccApp WMADZ.EXE Added by the RBOT-LJ WORM!
$statusbad$ X ccApp .EXE Added by the RBOT-LJ WORM!
$statusbad$ X ccApp gcasServ.exe Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name
$statusbad$ X Norton Auto-Protect ccApp.exe Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is "navapexe". This is also not the valid Norton AV file with the same filename

Name: CTFMON.EXE
Pfad: C:\WINDOWS\system32\ctfmon.exe
Ort: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
$statusbad$ X Ctfmon.exe ctfmon32.exe CoolWebSearch Ctfmon32 parasite variant
$statusbad$ X ctfmon.exe ctfmon.exe Added by the RAIDYS TROJAN! Note - this should not be confused with the valid Office XP file, see here
$statusbad$ X ctfmon.exe msupdate32.exe Spy Sheriff/SpywareNO malware, also detected as the SPYHOAX-A TROJAN, pretends to be a spyware remover! - file names spotted sofar include VXH8JKDQ2.EXE, NS6281400.so, CVXH8JKDQ2.EXE, down3.exe, sefe.exe, winstall.exe, and tool2.exe
$statusbad$ X ctfmon.exe ctfmon.exe CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see CIADOOR-Jhere. Ctfmon can be disabled from Control Panel, Text & Speech Services. Note - the file will always be located in the System32 folder, if it is located elsewhere it will likely be a worm or trojan! Can cause problems with some other programs if left enabled - see CIADOOR-Jhere for such an example

Hallo,
das sind alles haltlose Vermutungen von Hijackthisfree, kein Einziger dieser Einträge ist eine Bedrohung.
Kann man rausnehmen(da es ein Monitortool des Soundchipherstellers ist) muss man aber nicht.

P.S.
da habe ich falsch geraten :o


Grüße Wildone