|
MessengerSkinner ... HILFE :( Hallo Ich habe seit geraumer Zeit ein Problem und zwar: egal mit welchem Explorer ich ins Internet gehe (regelm. Firefox) öffnet der während ich im Netz bin neue Fenster mit Werbung. Ich hab mit Ad Aware, AGV und Spybot versucht das zeug loszuwerden, aber es klappt nicht. Spybot gibt an: "MessengerSkinner.rtk - 2 Trojans" kann diese aber nicht entfernen. hier ist mein HiJackThis Logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:34:31, on 21.11.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\carpserv.exe C:\Programme\Apoint\Apoint.exe C:\WINDOWS\system32\ICO.EXE C:\WINDOWS\System32\ezSP_Px.exe C:\Programme\Sony\HotKey Utility\HKserv.exe C:\Programme\FreePDF_XP\fpassist.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Windows Live\Messenger\MsnMsgr.Exe C:\dokumente und einstellungen\martina\lokale einstellungen\anwendungsdaten\dzpedr.exe C:\Programme\Apoint\Apntex.exe C:\Programme\Sony\HotKey Utility\HKWnd.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.club-vaio.sony-europe.com/ O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [dzpedr] "c:\dokumente und einstellungen\martina\lokale einstellungen\anwendungsdaten\dzpedr.exe" dzpedr O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.sony-europe.com/ O15 - Trusted Zone: *.sony-europe.com O15 - Trusted Zone: *.sonystyle-europe.com O15 - Trusted Zone: *.vaio-link.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1225236011809 O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe -- End of file - 6979 bytes Da ich kompletter Laie bin weiss ich nicht so recht was ich jetzt weiter machen soll um das zeug los zu werden. Kann mir irgendwer helfen?? Verzweifle hier total! :(( |
Hi, .Bitte lade Dir Navilog1 von IL-MAFIOSO herunter.
Hinweis: Navilog1.exe wir von einigen Antivirenprogrammen als bösartig erkannt. Dies ist ein Fehlalarm. Die Nachricht bitte ignorieren. lg myrtille |
vielen Dank für die schnelle Antwort myrtille! hier ist das log: was soll ich jetzt machen? Search Navipromo version 3.6.9 began on 21.11.2008 at 21:23:51,49 !!! Warning, this report may include legitimate files/programs !!! !!! Post this report on the forum you are being helped !!! !!! Don't continue with removal unless instructed by an authorized helper !!! Fix running from C:\Programme\navilog1 Actual User Account : "Martina" Updated on 05.11.2008 at 21h00 by IL-MAFIOSO Microsoft Windows XP [Version 5.1.2600] Version Internet Explorer : 7.0.5730.13 Filesystem type : NTFS Search done in normal mode *** Searching for installed Software *** Favorit *** Search folders in "C:\WINDOWS" *** *** Search folders in "C:\Programme" *** *** Search folders in "C:\Dokumente und Einstellungen\All Users\startm~1\progra~1" *** *** Search folders in "C:\Dokumente und Einstellungen\All Users\startm~1" *** *** Search folders in "c:\dokume~1\alluse~1\anwend~1" *** *** Search folders in "C:\Dokumente und Einstellungen\Martina\anwend~1" *** ...\MessengerSkinner found ! *** Search folders in "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" *** *** Search folders in "C:\Dokumente und Einstellungen\Martina\startm~1\progra~1" *** *** Search with Catchme-rootkit/stealth malware detector by gmer *** for more info : http://www.gmer.net *** Search with GenericNaviSearch *** !!! Possibility of legitimate files in the result !!! !!! Must always be checked before manually deleting !!! * Scan in "C:\WINDOWS\system32" * * Scan in "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" * *** Search files *** C:\WINDOWS\prefetch\MESSENGERSKINNER.EXE-0A815C61.pf found ! C:\WINDOWS\prefetch\MESSENGERSKINNER_SETUP.EXE-0ED9ECD4.pf found ! *** Search specific Registry keys *** HKEY_CURRENT_USER\Software\Lanconfig found ! *** Complementary Search *** (Search specific files) 1)Search new Instant Access files : 2)Heuristic Search : * In "C:\WINDOWS\system32" : * In "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" : dzpedr.exe found ! dzpedr.dat found ! dzpedr_nav.dat found ! dzpedr_navps.dat found ! 3)Certificates Search : Egroup certificate not found ! Electronic-Group certificate found ! Montorgueil certificate not found ! OOO-Favorit certificate found ! Sunny-Day-Design-Ltd certificate not found ! 4)Search known files : *** Search completed on 21.11.2008 at 21:29:09,26 *** |
Hi,
lg myrtille |
bedeutet das dass er den jetzt gelöscht hat?? Navipromo Removal version 3.6.9 started on 22.11.2008 at 10:34:17,27 Fix running from C:\Programme\navilog1 Actual User Account : "Martina" Updated on 05.11.2008 at 21h00 by IL-MAFIOSO Microsoft Windows XP [Version 5.1.2600] Internet Explorer : 7.0.5730.13 Filesystem type : NTFS Automatic removal with Catchme and GNS results Cleanning stage done on Reboot *** fsbl1.txt not found *** (Check that Catchme found nothing in Search Mode) *** Deleting with Backups GenericNaviSearch results *** * Deletion in "C:\WINDOWS\System32" * * Deletion in "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" * *** Deleting folders in "C:\WINDOWS" *** *** Deleting folders in "C:\Programme" *** *** Deleting folders in "C:\Dokumente und Einstellungen\All Users\startm~1\progra~1" *** *** Deleting folders in "C:\Dokumente und Einstellungen\All Users\startm~1" *** *** Deleting folders in "c:\dokume~1\alluse~1\anwend~1" *** *** Deleting folders in "C:\Dokumente und Einstellungen\Martina\anwend~1" *** ...\MessengerSkinner ...deleting... ...\MessengerSkinner deleted ! *** Deleting folders in "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" *** *** Deleting folders in "C:\Dokumente und Einstellungen\Martina\startm~1\progra~1" *** *** Deleting files *** C:\WINDOWS\prefetch\MESSENGERSKINNER.EXE-0A815C61.pf deleted ! C:\WINDOWS\prefetch\MESSENGERSKINNER_SETUP.EXE-0ED9ECD4.pf deleted ! *** Deleting temporary files *** Cleaning of C:\WINDOWS\Temp done ! Cleaning of C:\Dokumente und Einstellungen\Martina\lokale~1\Temp done ! *** Complementary Search *** (Search specific files) 1)Deletion with backups new Instant Access files: 2)Heuristic search and deletion with backups : * In "C:\WINDOWS\system32" * * In "C:\Dokumente und Einstellungen\Martina\lokale~1\anwend~1" * dzpedr.exe found ! Copy dzpedr.exe done ! dzpedr.exe deleted ! dzpedr.dat found ! Copy dzpedr.dat done ! dzpedr.dat deleted ! dzpedr_nav.dat found ! Copy dzpedr_nav.dat done ! dzpedr_nav.dat deleted ! dzpedr_navps.dat found ! Copy dzpedr_navps.dat done ! dzpedr_navps.dat deleted ! C:\WINDOWS\prefetch\dzpedr*.pf found ! Copy C:\WINDOWS\prefetch\dzpedr*.pf done ! C:\WINDOWS\prefetch\dzpedr*.pf deleted ! *** Copy Registry to Safebackup folder *** Backing up Registry done ! *** Cleaning Registry *** Registry cleaned *** Certificates *** Egroup Certificate not found ! Electronic-Group Certificate deleted ! Montorgueil Certificate not found ! OOO-Favorit Certificate deleted ! Sunny-Day-Design-Ltd Certificate not found ! *** Cleaning stage complete on 22.11.2008 at 10:37:44,24 *** |
Hi, ja,navilog wurde extra für befälle wie messengerskinner entwickelt. Das heißt das sollte es eigentlcih gewesen sein. ;) Deinstalliere bitte noch Navilog und lösche den Ordner C:\Programme\Navilog. lg myrtille |
VIIIIIIEEEEELEEEEEEEN Dank!!!! Kann ich dir irgendwie ne Weinflasche zukommenlassen? :) |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 00:27 Uhr. |
Copyright ©2000-2025, Trojaner-Board