Home » Spyware & Browser Hijacker Support Forum » PSGuard... Intell32.exe lässt sich nicht töten... Warning your Computer... » Themenansicht
PSGuard... Intell32.exe lässt sich nicht töten... Warning your Computer...Thema ist geschlossen! |
||
|---|---|---|
Thema ist geschlossen! |
||
| #0
| ||
|
01.08.2005, 21:12
Member
 Beiträge: 4730 |
||
 
|
|
|
|
01.08.2005, 21:29
Ehrenmitglied
 Beiträge: 29434 |
#17
Hallo@Hippie
einzelne "exe" ueberpruefen http://www.virustotal.com/flash/index_en.html Oben auf der Seite auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten und danach das Ergebnis abkopieren und hier im Beitrag posten C:\WINNT\system32\MSTask.exe •KillBox http://bilder.informationsarchiv.net/Nikitas_Tools/KillBox.zip Anleitung: (bebildert) http://virus-protect.org/killbox.html •Delete File on Reboot <--anhaken und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "----> klicke auf "no",und kopiere das naechste rein, erst beim letzten auf "yes" C:\WINNT\SYSTEM32\tcpGDC.dll C:\WINNT\System32\intell32.exe C:\WINNT\System32\sqlkhpm.dll PC neustarten _______________________________________________________________ Start--> Ausfuehren--> cmd--> kopiere nur die Eintraege der letzten Tage raus einzeln reinkopieren: cd\ cd %windir%\system32 dir /a:-d /o:-d > %systemdrive%\system32.txt start %systemdrive%\system32.txt cls exit cd\ cd %temp%\ dir /a:-d /o:-d > %systemdrive%\systemtemp.txt start %systemdrive%\systemtemp.txt cls exit cd\ cd %windir% dir /a:-d /o:-d > %systemdrive%\system.txt start %systemdrive%\system.txt cls exit cd\ dir /a:-d /o:-d > %systemdrive%\sys.txt start %systemdrive%\sys.txt cls exit -------------- Zitat INFO: __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
01.08.2005, 22:45
Member
Beiträge: 17 |
#18
Hi,
also ich habe jetzt im abgesicherten Modus die Dateien gefixt. intel32. war sofort wieder da nach dem Neustart.... :---((( -------------------------------------------------- -------------------- INFECTED -------------------- -------------------------------------------------- 1: Mon Aug 01 21:25:07 2005 => File C:\WINNT\system32\WININET.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No Action Taken. 2: Mon Aug 01 21:25:44 2005 => System found infected with Hijack Spyware/Adware ({771A1334-6B08-4A6B-AEDC-CF994BA2CEBE})! Action taken: No Action Taken. 3: Mon Aug 01 21:25:44 2005 => System found infected with ISTSvc Spyware/Adware ({DB447818-96B4-40DF-8A55-720DA496F514})! Action taken: No Action Taken. 4: Mon Aug 01 21:25:44 2005 => System found infected with ISTSvc Spyware/Adware ({BF06DA8E-2BEB-4816-9BBD-F7625246E245})! Action taken: No Action Taken. 5: Mon Aug 01 21:25:45 2005 => System found infected with DyFuCA Spyware/Adware ({AA4939C3-DECA-4A48-A454-97CD587C0EF5})! Action taken: No Action Taken. 6: Mon Aug 01 21:25:45 2005 => System found infected with DyFuCA Spyware/Adware ({EEE4A2E5-9F56-432F-A6ED-F6F625B551E0})! Action taken: No Action Taken. 7: Mon Aug 01 21:25:45 2005 => System found infected with SideFind Spyware/Adware ({10e42047-deb9-4535-a118-b3f6ec39b807})! Action taken: No Action Taken. 8: Mon Aug 01 21:26:43 2005 => System found infected with Roings Spyware/Adware (objsafe.tlb)! Action taken: No Action Taken. 9: Mon Aug 01 21:27:13 2005 => System found infected with adtools Spyware/Adware (adtoolsx.dll)! Action taken: No Action Taken. 10: Mon Aug 01 21:27:13 2005 => System found infected with ISTsvc Spyware/Adware (shortcuts.txt)! Action taken: No Action Taken. 11: Mon Aug 01 21:27:13 2005 => System found infected with YourSiteBar Spyware/Adware (YSBactivex.dll)! Action taken: No Action Taken. 12: Mon Aug 01 21:27:45 2005 => File C:\WINNT\notepad.com infected by "Trojan-Downloader.Win32.Delf.ks" Virus! Action Taken: No Action Taken. 13: Mon Aug 01 21:28:45 2005 => File C:\WINNT\System32\intell32.exe infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No Action Taken. 14: Mon Aug 01 21:30:13 2005 => File C:\WINNT\System32\wininet.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No Action Taken. 15: Mon Aug 01 21:38:57 2005 => Scanning File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\pft4.tmp\program files\Kaspersky Lab\Kaspersky Anti-Virus Lite\Infected.wav [**] 16: Mon Aug 01 21:40:33 2005 => File C:\!Submit\intell32.exe infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No Action Taken. 17: Mon Aug 01 21:47:11 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-3518a193-716d800e.zip infected by "Trojan-Downloader.Java.OpenStream.q" Virus! Action Taken: No Action Taken. 18: Mon Aug 01 21:47:12 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-5ab998ef-1e524670.zip infected by "Trojan-Downloader.Java.OpenConnection.v" Virus! Action Taken: No Action Taken. 19: Mon Aug 01 21:47:13 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-1f121070-4e4d620c.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 20: Mon Aug 01 21:47:13 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-314ecd83-6d5bb9aa.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 21: Mon Aug 01 21:47:13 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-38449c9-257344cc.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 22: Mon Aug 01 21:47:14 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-5cd7e2a9-74a4234a.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 23: Mon Aug 01 21:47:14 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-5fd982b6-7934aed7.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 24: Mon Aug 01 21:47:14 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-77d115ef-257dbddf.zip infected by "Trojan-Dropper.Java.Beyond.h" Virus! Action Taken: No Action Taken. 25: Mon Aug 01 21:47:14 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-bc22602-6b783700.zip infected by "Trojan.Java.ClassLoader.k" Virus! Action Taken: No Action Taken. 26: Mon Aug 01 21:47:19 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\dialarch.jar-4cc550e9-18283f43.zip infected by "Trojan-Downloader.Java.OpenStream.v" Virus! Action Taken: No Action Taken. 27: Mon Aug 01 21:47:31 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\nocheat.jar-606e43b8-49b5adc7.zip infected by "Trojan.Java.ClassLoader.c" Virus! Action Taken: No Action Taken. 28: Mon Aug 01 21:47:35 2005 => File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\x4yipafw1.jar-7c59fa2d-281f41d1.zip infected by "Trojan-Downloader.Java.OpenStream.s" Virus! Action Taken: No Action Taken. 29: Mon Aug 01 21:55:59 2005 => Scanning File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\pft4.tmp\program files\Kaspersky Lab\Kaspersky Anti-Virus Lite\Infected.wav [**] 30: Mon Aug 01 22:02:19 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.* 31: Mon Aug 01 22:12:22 2005 => File C:\WINNT\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ9.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken. 32: Mon Aug 01 22:12:25 2005 => File C:\WINNT\Downloaded Program Files\YSBactivex.dll infected by "Trojan-Downloader.Win32.IstBar.gz" Virus! Action Taken: No Action Taken. 33: Mon Aug 01 22:17:42 2005 => File C:\WINNT\notepad.com infected by "Trojan-Downloader.Win32.Delf.ks" Virus! Action Taken: No Action Taken. 34: Mon Aug 01 22:23:06 2005 => File C:\WINNT\system32\intell32.exe infected by "Trojan.Win32.Small.ev" Virus! Action Taken: No Action Taken. 35: Mon Aug 01 22:25:11 2005 => File C:\WINNT\system32\wininet.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No Action Taken. -------------------------------------------------- --------------------- TAGGED --------------------- -------------------------------------------------- 1: Mon Aug 01 22:10:54 2005 => File C:\Programme\SearchRelevant\SearchRelevant.dll tagged as "not-a-virus:AdWare.Relevance.c". Action Taken: No Action Taken. 2: Mon Aug 01 22:10:54 2005 => File C:\Programme\SearchRelevant\SearchRelevant5.dll tagged as "not-a-virus:AdWare.Relevance.c". Action Taken: No Action Taken. 3: Mon Aug 01 22:12:22 2005 => File C:\WINNT\Downloaded Program Files\CONFLICT.1\AdToolsX.dll tagged as "not-a-virus:AdWare.WinAD.x". Action Taken: No Action Taken. 4: Mon Aug 01 22:12:22 2005 => File C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx tagged as "not-a-virus:AdWare.MediaTickets.f". Action Taken: No Action Taken. 5: Mon Aug 01 22:12:22 2005 => File C:\WINNT\Downloaded Program Files\CONFLICT.1\PrevAdX.dll tagged as "not-a-virus:AdWare.WinAD.aa". Action Taken: No Action Taken. 6: Mon Aug 01 22:12:24 2005 => File C:\WINNT\Downloaded Program Files\PrevAdX.dll tagged as "not-a-virus:AdWare.WinAD.aa". Action Taken: No Action Taken. 7: Mon Aug 01 22:12:25 2005 => File C:\WINNT\Downloaded Program Files\WinFormX.dll tagged as "not-a-virus:AdWare.WinAD.w". Action Taken: No Action Taken. -------------------------------------------------- --------------------- ERRORS --------------------- -------------------------------------------------- 1: Mon Aug 01 21:25:37 2005 => ERROR!!! Invalid Entry \??\C:\WINNT\system32\msftcpip.sys in SYSTEM\CurrentControlSet\Services\msftcpip... 2: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\access_special.ocx". Action Taken: No Action Taken. 3: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken. 4: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\AdToolsX.dll". Action Taken: No Action Taken. 5: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken. 6: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\WinadX.dll". Action Taken: No Action Taken. 7: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\ysbactivex.dll". Action Taken: No Action Taken. 8: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\inst2.dll". Action Taken: No Action Taken. 9: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\internazionale_ver10.ocx". Action Taken: No Action Taken. 10: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken. 11: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ITDetector.ocx". Action Taken: No Action Taken. 12: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. 13: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. 14: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\PPSDKActiveXScanner.ocx". Action Taken: No Action Taken. 15: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken. 16: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\sl.ocx". Action Taken: No Action Taken. 17: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdCtlX.dll". Action Taken: No Action Taken. 18: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\WinTaskAdX.dll". Action Taken: No Action Taken. 19: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\vbiewer.ocx". Action Taken: No Action Taken. 20: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebUncoated.icc". Action Taken: No Action Taken. 21: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AppleRGB.icc". Action Taken: No Action Taken. 22: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\ColorMatchRGB.icc". Action Taken: No Action Taken. 23: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleCoated.icc". Action Taken: No Action Taken. 24: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleUncoated.icc". Action Taken: No Action Taken. 25: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\JapanStandard.icc". Action Taken: No Action Taken. 26: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\sRGB Color Space Profile.icm". Action Taken: No Action Taken. 27: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedCoated.icc". Action Taken: No Action Taken. 28: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedUncoated.icc". Action Taken: No Action Taken. 29: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebCoatedSWOP.icc". Action Taken: No Action Taken. 30: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AdobeRGB1998.icc". Action Taken: No Action Taken. 31: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\WideGamutRGB.icc". Action Taken: No Action Taken. 32: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\NTSC1953.icc". Action Taken: No Action Taken. 33: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\PAL_SECAM.icc". Action Taken: No Action Taken. 34: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\SMPTE-C.icc". Action Taken: No Action Taken. 35: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\CIERGB.icc". Action Taken: No Action Taken. 36: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop5DefaultCMYK.icc". Action Taken: No Action Taken. 37: Mon Aug 01 21:27:14 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop4DefaultCMYK.icc". Action Taken: No Action Taken. 38: Mon Aug 01 21:27:15 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe\Photoshop Album\Kataloge\My Catalog.psa". Action Taken: No Action Taken. 39: Mon Aug 01 21:27:15 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. 40: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\RealArcadeRdxIE.dll". Action Taken: No Action Taken. 41: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\WinadX.dll". Action Taken: No Action Taken. 42: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\vbiewer.ocx". Action Taken: No Action Taken. 43: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdCtlX.dll". Action Taken: No Action Taken. 44: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinTaskAdX.dll". Action Taken: No Action Taken. 45: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\sl.ocx". Action Taken: No Action Taken. 46: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ITDetector.ocx". Action Taken: No Action Taken. 47: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\access_special.ocx". Action Taken: No Action Taken. 48: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\inst2.dll". Action Taken: No Action Taken. 49: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken. 50: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\AdToolsX.dll". Action Taken: No Action Taken. 51: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. 52: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken. 53: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. 54: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\internazionale_ver10.ocx". Action Taken: No Action Taken. 55: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\ysbactivex.dll". Action Taken: No Action Taken. 56: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\PPSDKActiveXScanner.ocx". Action Taken: No Action Taken. 57: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken. 58: Mon Aug 01 21:27:16 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken. 59: Mon Aug 01 21:27:17 2005 => Entry "HKCR\CLSID\{0054F4EE-9A54-47F8-BDB8-3FB747D0059E}" refers to invalid object "C:\WINNT\System32\mddknb.dll". Action Taken: No Action Taken. 60: Mon Aug 01 21:27:17 2005 => Entry "HKCR\CLSID\{03A94962-9DF7-4ACE-A885-3E5C71DF891D}" refers to invalid object "C:\WINNT\System32\gbealoa.dll". Action Taken: No Action Taken. 61: Mon Aug 01 21:27:18 2005 => Entry "HKCR\CLSID\{0553551A-DDA6-4260-B545-5F3044C8882A}" refers to invalid object "C:\WINNT\System32\omfn.dll". Action Taken: No Action Taken. 62: Mon Aug 01 21:27:18 2005 => Entry "HKCR\CLSID\{0A5F8451-E204-4933-8D14-1B8B50C9E3BB}" refers to invalid object "C:\WINNT\System32\poph.dll". Action Taken: No Action Taken. 63: Mon Aug 01 21:27:19 2005 => Entry "HKCR\CLSID\{26EBD9DC-24D5-4779-B6F7-BF263091728F}" refers to invalid object "C:\WINNT\System32\dgch.dll". Action Taken: No Action Taken. 64: Mon Aug 01 21:27:19 2005 => Entry "HKCR\CLSID\{276EF59C-B55B-4A2D-AAC4-BA23C23ABE75}" refers to invalid object "C:\WINNT\System32\bgmd.dll". Action Taken: No Action Taken. 65: Mon Aug 01 21:27:19 2005 => Entry "HKCR\CLSID\{2A125652-5359-408E-A1AD-F289207847D0}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 66: Mon Aug 01 21:27:19 2005 => Entry "HKCR\CLSID\{2CB0B121-5E9E-4B59-B00D-C2D5B84A33B6}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 67: Mon Aug 01 21:27:20 2005 => Entry "HKCR\CLSID\{2E541280-07AF-4FBC-A657-6583B7453416}" refers to invalid object "C:\WINNT\System32\mcgn.dll". Action Taken: No Action Taken. 68: Mon Aug 01 21:27:20 2005 => Entry "HKCR\CLSID\{39BE9181-0C1F-4EA3-A8A2-93C6C9C66287}" refers to invalid object "C:\WINNT\System32\cpfgo.dll". Action Taken: No Action Taken. 69: Mon Aug 01 21:27:21 2005 => Entry "HKCR\CLSID\{3C8116EA-0209-468C-8F3C-28C157ED4B2C}" refers to invalid object "C:\WINNT\System32\poph.dll". Action Taken: No Action Taken. 70: Mon Aug 01 21:27:21 2005 => Entry "HKCR\CLSID\{49F774AE-AA80-43B2-B080-5089EE02B863}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. 71: Mon Aug 01 21:27:24 2005 => Entry "HKCR\CLSID\{6BFFC078-0D8B-48F6-A532-A5B76F7873B5}" refers to invalid object "C:\WINNT\System32\aodn.dll". Action Taken: No Action Taken. 72: Mon Aug 01 21:27:26 2005 => Entry "HKCR\CLSID\{7B88A9DA-9D84-4085-AE5E-0AB5B4020168}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. 73: Mon Aug 01 21:27:26 2005 => Entry "HKCR\CLSID\{8150DB39-F2A5-4D9F-9816-ABE5F6A21BDB}" refers to invalid object "C:\WINNT\System32\jild.dll". Action Taken: No Action Taken. 74: Mon Aug 01 21:27:26 2005 => Entry "HKCR\CLSID\{850486BA-85D9-41AB-B941-B3715105541E}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. 75: Mon Aug 01 21:27:26 2005 => Entry "HKCR\CLSID\{8D3E8259-C86C-4803-879F-E5592AEFAD58}" refers to invalid object "C:\WINNT\System32\iml.dll". Action Taken: No Action Taken. 76: Mon Aug 01 21:27:26 2005 => Entry "HKCR\CLSID\{8F6770E1-6CD4-4D75-B151-CE5B284074E5}" refers to invalid object "C:\WINNT\System32\iafk.dll". Action Taken: No Action Taken. 77: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken. 78: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A1ACF3EE-0859-497D-9978-4207D6CC6ABA}" refers to invalid object "C:\WINNT\System32\jaeek.dll". Action Taken: No Action Taken. 79: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A2B25BF3-F983-478D-BF4D-8BBA397EEE94}" refers to invalid object "C:\WINNT\System32\klee.dll". Action Taken: No Action Taken. 80: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A4383BB8-BDF5-436D-A56B-97815256516A}" refers to invalid object "C:\WINNT\System32\iml.dll". Action Taken: No Action Taken. 81: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken. 82: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A660FE50-C65E-4F9A-8F3B-CA4A2CAFBC04}" refers to invalid object "C:\WINNT\System32\jkjii.dll". Action Taken: No Action Taken. 83: Mon Aug 01 21:27:27 2005 => Entry "HKCR\CLSID\{A8701B43-35AD-4386-A2F1-BB1D2631E95E}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 84: Mon Aug 01 21:27:28 2005 => Entry "HKCR\CLSID\{B5DD9A64-5C4B-4a48-BE56-97C1A8F85708}" refers to invalid object "C:\WINNT\System32\fastvideoplayer.dll". Action Taken: No Action Taken. 85: Mon Aug 01 21:27:28 2005 => Entry "HKCR\CLSID\{BB876D9B-FD9A-4B8A-91AF-035CA10220EB}" refers to invalid object "C:\WINNT\System32\aplf.dll". Action Taken: No Action Taken. 86: Mon Aug 01 21:27:28 2005 => Entry "HKCR\CLSID\{BE4ED391-2174-4F52-B1CA-94025A7FFE6F}" refers to invalid object "C:\WINNT\System32\afhk.dll". Action Taken: No Action Taken. 87: Mon Aug 01 21:27:28 2005 => Entry "HKCR\CLSID\{C66758C8-F7F4-4E8D-B6F4-1C495CAA8986}" refers to invalid object "C:\WINNT\System32\kmfl.dll". Action Taken: No Action Taken. 88: Mon Aug 01 21:27:28 2005 => Entry "HKCR\CLSID\{C7C19DF2-8C12-4454-833C-C0BE68451899}" refers to invalid object "C:\WINNT\System32\ikci.dll". Action Taken: No Action Taken. 89: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{D2047107-B96A-4497-9ED8-92D8984F8E22}" refers to invalid object "C:\WINNT\System32\aplf.dll". Action Taken: No Action Taken. 90: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{D249C888-F345-4A61-A341-78E679C8FA56}" refers to invalid object "C:\WINNT\System32\dnjo.dll". Action Taken: No Action Taken. 91: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{D54D3AC9-1C66-46BD-9939-15593C38FD2D}" refers to invalid object "C:\WINNT\System32\nkjo.dll". Action Taken: No Action Taken. 92: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{DB7E8122-F380-4629-A769-51F7358FC5CC}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 93: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{E07D3492-32B5-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken. 94: Mon Aug 01 21:27:29 2005 => Entry "HKCR\CLSID\{E408D19A-C1D0-4582-9C73-44F613D4CEE4}" refers to invalid object "C:\WINNT\System32\bdfh.dll". Action Taken: No Action Taken. 95: Mon Aug 01 21:27:30 2005 => Entry "HKCR\CLSID\{EA1F2EAC-FBFE-4516-A1E7-D0C52B55EF3C}" refers to invalid object "C:\WINNT\System32\hlpg.dll". Action Taken: No Action Taken. 96: Mon Aug 01 21:27:30 2005 => Entry "HKCR\CLSID\{EC73CC41-BD6A-451F-A2A6-9787D8CA54C2}" refers to invalid object "C:\WINNT\System32\ddoe.dll". Action Taken: No Action Taken. 97: Mon Aug 01 21:27:30 2005 => Entry "HKCR\CLSID\{F023A865-0E69-4E0C-A0CA-8ABEE9F5A3EC}" refers to invalid object "C:\WINNT\System32\pijf.dll". Action Taken: No Action Taken. 98: Mon Aug 01 21:27:30 2005 => Entry "HKCR\CLSID\{F5528638-5B7C-4D44-A96C-133A8FB237C2}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 99: Mon Aug 01 21:27:31 2005 => Entry "HKCR\CLSID\{FD72C2D0-0612-42CF-AD09-F0760076B9A4}" refers to invalid object "C:\WINNT\System32\cpfgo.dll". Action Taken: No Action Taken. 100: Mon Aug 01 21:27:31 2005 => Entry "HKCR\CLSID\{FF0BD327-9ED1-42DC-8920-788CB9A8CCC4}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. 101: Mon Aug 01 21:27:32 2005 => Entry "HKCR\AcroIEHelper.AcroIEHlprObj" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken. 102: Mon Aug 01 21:27:32 2005 => Entry "HKCR\AcroIEHelper.AcroIEHlprObj.1" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken. 103: Mon Aug 01 21:27:32 2005 => Entry "HKCR\ActMsg.Session" refers to invalid object "{3FA7DEB3-6438-101B-ACC1-00AA00423326}". Action Taken: No Action Taken. 104: Mon Aug 01 21:27:33 2005 => Entry "HKCR\AdToolsX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. 105: Mon Aug 01 21:27:36 2005 => Entry "HKCR\IETLBAss.DOMP" refers to invalid object "{4C1B116F-2860-46db-8E6C-B4BFC4DFD683}". Action Taken: No Action Taken. 106: Mon Aug 01 21:27:36 2005 => Entry "HKCR\IETLBAss.DOMP.1" refers to invalid object "{4C1B116F-2860-46db-8E6C-B4BFC4DFD683}". Action Taken: No Action Taken. 107: Mon Aug 01 21:27:36 2005 => Entry "HKCR\ISTx.Installer.2" refers to invalid object "{7C559105-9ECF-42b8-B3F7-832E75EDD959}". Action Taken: No Action Taken. 108: Mon Aug 01 21:27:37 2005 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. 109: Mon Aug 01 21:27:37 2005 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. 110: Mon Aug 01 21:27:37 2005 => Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. 111: Mon Aug 01 21:27:37 2005 => Entry "HKCR\MediaAccX.Installer" refers to invalid object "{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. 112: Mon Aug 01 21:27:39 2005 => Entry "HKCR\PrevAdX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. 113: Mon Aug 01 21:27:40 2005 => Entry "HKCR\SearchRelevant" refers to invalid object "{1D7E3B41-23CE-469B-BE1B-A64B877923E1}". Action Taken: No Action Taken. 114: Mon Aug 01 21:27:41 2005 => Entry "HKCR\Updater.BHO" refers to invalid object "{1D7E3B41-23CE-469B-BE1B-A64B877923E1}". Action Taken: No Action Taken. 115: Mon Aug 01 21:27:41 2005 => Entry "HKCR\WinFormX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. 116: Mon Aug 01 21:27:41 2005 => Entry "HKCR\WinStatX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. 117: Mon Aug 01 21:30:24 2005 => Result: ERROR!!! File C:\WINNT\System32\?ti2evxx.exe: Scanning Failure!!! 118: Mon Aug 01 21:30:24 2005 => ERROR!!! ScanFile fails for C:\WINNT\System32\?ti2evxx.exe 119: Mon Aug 01 21:59:25 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Advertisingcom.zip is Not Scanned 120: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Advertisingcom1.zip is Not Scanned 121: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Advertisingcom2.zip is Not Scanned 122: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Advertisingcom3.zip is Not Scanned 123: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\AlexaRelated.zip is Not Scanned 124: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\AlexaRelated1.zip is Not Scanned 125: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CommissionJunction.zip is Not Scanned 126: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch.zip is Not Scanned 127: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch1.zip is Not Scanned 128: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch10.zip is Not Scanned 129: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch11.zip is Not Scanned 130: Mon Aug 01 21:59:26 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch2.zip is Not Scanned 131: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch3.zip is Not Scanned 132: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch4.zip is Not Scanned 133: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch5.zip is Not Scanned 134: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch6.zip is Not Scanned 135: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch7.zip is Not Scanned 136: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch8.zip is Not Scanned 137: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\CoolWWWSearch9.zip is Not Scanned 138: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\DSOExploit.zip is Not Scanned 139: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\FastClick.zip is Not Scanned 140: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\FastClick1.zip is Not Scanned 141: Mon Aug 01 21:59:27 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\HitBox.zip is Not Scanned 142: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\HitBox1.zip is Not Scanned 143: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\HitBox2.zip is Not Scanned 144: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\HitBox3.zip is Not Scanned 145: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\MediaPlex.zip is Not Scanned 146: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\MediaPlex1.zip is Not Scanned 147: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Possiblehijacker.zip is Not Scanned 148: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Possiblehijacker1.zip is Not Scanned 149: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Possiblehijacker2.zip is Not Scanned 150: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\Possiblehijacker3.zip is Not Scanned 151: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\SexList.zip is Not Scanned 152: Mon Aug 01 21:59:28 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\SexList1.zip is Not Scanned 164: Mon Aug 01 21:59:29 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\WindowsMediaPlayer.zip is Not Scanned 165: Mon Aug 01 21:59:30 2005 => Result: ERROR!!! File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy\Recovery\WinGuardian.zip is Not Scanned 166: Mon Aug 01 22:25:21 2005 => Result: ERROR!!! File C:\WINNT\system32\?ti2evxx.exe: Scanning Failure!!! 167: Mon Aug 01 22:25:21 2005 => ERROR!!! ScanFile fails for C:\WINNT\system32\?ti2evxx.exe -------------------------------------------------- -------- DATEIEN ZUM LÖSCHEN HINZUGEFÜGT --------- -------------------------------------------------- 1: C:\WINNT\system32\WININET.dll => Virus.Win32.Nsag.b 2: C:\WINNT\notepad.com => Trojan-Downloader.Win32.Delf.ks 3: C:\WINNT\System32\intell32.exe => Trojan.Win32.Small.ev 4: C:\WINNT\System32\wininet.dll => Virus.Win32.Nsag.b 5: C:\!Submit\intell32.exe => Trojan.Win32.Small.ev 6: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arc.jar-3518a193-716d800e.zip => Trojan-Downloader.Java.OpenStream.q 7: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-5ab998ef-1e524670.zip => Trojan-Downloader.Java.OpenConnection.v 8: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-1f121070-4e4d620c.zip => Trojan.Java.ClassLoader.k 9: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-314ecd83-6d5bb9aa.zip => Trojan.Java.ClassLoader.k 10: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-38449c9-257344cc.zip => Trojan.Java.ClassLoader.k 11: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-5cd7e2a9-74a4234a.zip => Trojan.Java.ClassLoader.k 12: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-5fd982b6-7934aed7.zip => Trojan.Java.ClassLoader.k 13: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-77d115ef-257dbddf.zip => Trojan-Dropper.Java.Beyond.h 14: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-bc22602-6b783700.zip => Trojan.Java.ClassLoader.k 15: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\dialarch.jar-4cc550e9-18283f43.zip => Trojan-Downloader.Java.OpenStream.v 16: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\nocheat.jar-606e43b8-49b5adc7.zip => Trojan.Java.ClassLoader.c 17: C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\x4yipafw1.jar-7c59fa2d-281f41d1.zip => Trojan-Downloader.Java.OpenStream.s 18: C:\WINNT\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ9.exe => Trojan-Downloader.Win32.Adload.a 19: C:\WINNT\Downloaded Program Files\YSBactivex.dll => Trojan-Downloader.Win32.IstBar.gz 20: C:\WINNT\system32\intell32.exe => Trojan.Win32.Small.ev 21: C:\WINNT\system32\wininet.dll => Virus.Win32.Nsag.b -------------------------------------------------- -------------------- Statistik ------------------- -------------------------------------------------- Mon Aug 01 22:25:29 2005 => Total Objects Scanned: 50013 Mon Aug 01 22:25:29 2005 => Total Virus(es) Found: 43 Mon Aug 01 22:25:29 2005 => Total Errors: 165 Mon Aug 01 22:25:29 2005 => Virus Database Date: 2005/08/01 Mon Aug 01 22:25:29 2005 => Virus Database Count: 141545 Mon Aug 01 22:26:13 2005 => Total Objects Scanned: 50013 Mon Aug 01 22:26:13 2005 => Total Virus(es) Found: 43 Mon Aug 01 22:26:13 2005 => Total Errors: 165 Hier aber der Report von mstask.exe. This is a report processed by VirusTotal on 08/01/2005 at 22:42:19 (CET) after scanning the file "mstask.exe" file. Antivirus Version Update Result AntiVir 6.31.1.0 08.01.2005 no virus found AVG 718 08.01.2005 no virus found Avira 6.31.1.0 08.01.2005 no virus found BitDefender 7.0 07.29.2005 no virus found CAT-QuickHeal 7.03 08.01.2005 no virus found ClamAV devel-20050725 07.31.2005 no virus found DrWeb 4.32b 08.01.2005 no virus found eTrust-Iris 7.1.194.0 07.30.2005 no virus found eTrust-Vet 11.9.1.0 08.01.2005 no virus found Fortinet 2.36.0.0 07.30.2005 no virus found F-Prot 3.16c 08.01.2005 no virus found Ikarus 0.2.59.0 08.01.2005 no virus found Kaspersky 4.0.2.24 08.01.2005 no virus found McAfee 4547 08.01.2005 no virus found NOD32v2 1.1184 08.01.2005 no virus found Norman 5.70.10 08.01.2005 no virus found Panda 8.02.00 08.01.2005 no virus found Sophos 3.96.0 08.01.2005 no virus found Sybari 7.5.1314 08.01.2005 no virus found Symantec 8.0 08.01.2005 no virus found TheHacker 5.8.2.079 08.01.2005 no virus found VBA32 3.10.4 08.01.2005 no virus found VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español -------------------------------------------------------------------------------- www.virustotal.com :: @ Hispasec Sistemas 2004 :: e-mail info@virustotal.com Dieser Beitrag wurde am 02.08.2005 um 00:04 Uhr von Hippie editiert.
|
|
|
|
|
|
|
01.08.2005, 23:08
Member
Beiträge: 17 |
#19
Hallo Sabina,
leider kommt bei der sq.... nur: File size can't be more than 2 Megabytes. You can't try compressing it. Thanks you. << Go back was kann man aus diesem Datien herauslesen? 01.08.2005 22:54 6.144 intell32.exe 01.08.2005 22:53 0 pavjob.log 31.07.2005 11:39 16.384 Perflib_Perfdata_204.dat 28.06.2005 07:32 99.678 wp.bmp 28.06.2005 07:32 22.528 shdocpv.dll 21.03.2005 08:20 0 qci0cie1.html 17.03.2005 14:56 417.792 ?ti2evxx.exe 04.03.2005 08:55 2.975 gah95on6.ini 04.03.2005 08:55 0 tovjeapl.html 11.02.2005 08:24 1.029 b315cfed.dat 08.02.2005 18:04 35 70tovmto.ini 08.02.2005 18:04 35 bln02nqv.ini 08.02.2005 08:55 9.856 kdlmjh8r.dat 08.02.2005 08:55 176.032 tm97pj39.dat 08.02.2005 08:55 2.832 p1fumi62.dat 08.02.2005 08:55 0 goreggbk.dat 29.01.2005 00:38 2.832 vp.dat 27.01.2005 09:12 57.344 sqlkhpm.dll 15.01.2005 18:33 99.480 FWSVPN.DLL 1.08.2005 22:47 16.384 ~DF2153.tmp 01.08.2005 22:46 847 kb.log 01.08.2005 22:45 16.384 ~DFB163.tmp 01.08.2005 22:26 16.384 ~DF42F3.tmp 01.08.2005 21:30 16.384 ~DFC396.tmp 01.08.2005 21:23 16.384 ~DF52E0.tmp 01.08.2005 21:22 16.384 ~DF37A2.tmp 31.07.2005 23:23 16.384 ~DFA0C3.tmp 31.07.2005 22:46 46.552 escan_Result.txt 31.07.2005 20:14 8.195.584 mwav.exe 31.07.2005 19:55 0 ~4.tmp 31.07.2005 11:27 18.198 beoa.exe 31.07.2005 11:27 5.636 cmaa.exe 29.07.2005 21:27 33.280 ~WRS2075.tmp 29.07.2005 21:27 22.029 ~WRD0043.doc 29.07.2005 21:27 778 mso1BD.wmf 29.07.2005 21:27 425.984 ~WRF3060.tmp 29.07.2005 21:26 534 mso156.wmf 29.07.2005 21:26 640 mso3C0.wmf 29.07.2005 21:26 370 mso7F.wmf 29.07.2005 21:26 512 mso287.wmf 29.07.2005 21:26 470 mso240.wmf 29.07.2005 21:26 470 mso20E.wmf 29.07.2005 21:26 778 mso1DC.wmf 29.07.2005 21:26 662 mso1D2.wmf 29.07.2005 21:26 512 mso182.wmf 29.07.2005 21:26 534 msoB1.wmf 29.07.2005 21:25 534 mso381.wmf 29.07.2005 21:25 634 mso7D.wmf 29.07.2005 21:25 640 mso2C1.wmf 29.07.2005 21:25 640 mso86.wmf 29.07.2005 21:25 470 mso1B2.wmf 29.07.2005 21:25 470 msoC2.wmf 29.07.2005 21:25 778 msoAB.wmf 29.07.2005 21:25 470 mso325.wmf 29.07.2005 21:25 470 mso285.wmf 29.07.2005 21:25 850 mso192.wmf 29.07.2005 21:25 476 mso383.wmf 29.07.2005 21:25 476 mso2BB.wmf 29.07.2005 21:25 512 mso1AD.wmf 29.07.2005 21:25 512 mso2E2.wmf 29.07.2005 21:25 512 mso23A.wmf 29.07.2005 21:25 476 mso230.wmf 29.07.2005 21:25 370 mso226.wmf 29.07.2005 21:25 850 mso227.wmf 29.07.2005 21:25 370 mso1E0.wmf 29.07.2005 21:25 470 mso1C2.wmf 29.07.2005 21:25 370 mso1A4.wmf 29.07.2005 21:25 662 mso191.wmf 29.07.2005 21:25 778 mso19A.wmf 29.07.2005 21:25 634 mso172.wmf 29.07.2005 21:25 512 mso168.wmf 29.07.2005 21:24 534 mso2A1.wmf 29.07.2005 21:24 534 msoCA.wmf 29.07.2005 21:24 634 mso2BD.wmf 29.07.2005 21:24 634 mso141.wmf 29.07.2005 21:24 640 mso37A.wmf 29.07.2005 21:24 640 mso258.wmf 29.07.2005 21:24 778 mso95.wmf 29.07.2005 21:24 470 mso1B3.wmf 29.07.2005 21:24 470 mso3A6.wmf 29.07.2005 21:24 370 mso2D3.wmf 29.07.2005 21:24 370 msoC8.wmf 29.07.2005 21:24 370 msoE5.wmf 29.07.2005 21:24 850 mso274.wmf 29.07.2005 21:24 476 mso43.wmf 29.07.2005 21:24 476 mso395.wmf 29.07.2005 21:24 512 mso2A5.wmf 29.07.2005 21:24 512 mso330.wmf 28.07.2005 21:42 2.048.000 Acr2.tmp Dieser Beitrag wurde am 02.08.2005 um 00:11 Uhr von Hippie editiert.
|
|
|
|
|
|
|
01.08.2005, 23:30
Ehrenmitglied
Beiträge: 29434 |
#20
Hippie
Zitat Sabina postete __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
01.08.2005, 23:54
Member
Beiträge: 17 |
#21
So, ich habe viel gelöscht, ... die ganzen WINNT\DOWNLOADED PROGRAM FILES habe ich nicht..!?
Hier die wininet.bat C:\>dir C:\wininet.dll /a h /s 1>files.txt Datentr„ger in Laufwerk C: ist Lokaler Datentr„ger Datentr„gernummer: D864-23B8 Verzeichnis von C:\Programme\Adobe\Acrobat 5.0\Resource\CMap 15.03.2001 04:32 3.778 H 1 Datei(en) 3.778 Bytes Verzeichnis von C:\WINNT 17.08.2001 22:34 583.680 wininet.dll 1 Datei(en) 583.680 Bytes Verzeichnis von C:\WINNT\system32 29.08.2002 10:32 590.848 wininet.dll 1 Datei(en) 590.848 Bytes Verzeichnis von C:\WINNT\system32\dllcache 29.08.2002 10:32 590.848 wininet.dll 1 Datei(en) 590.848 Bytes Anzahl der angezeigten Dateien: 4 Datei(en) 1.769.154 Bytes 0 Verzeichnis(se), 2.526.904.320 Bytes frei Dazu mal mein HJT: Logfile of HijackThis v1.99.1 Scan saved at 00:00:00, on 02.08.2005 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\Panda Software\Panda Antivirus Platinum\pavsrv50.exe C:\WINNT\system32\regsvc.exe C:\Programme\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\WINNT\Explorer.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINNT\System32\intell32.exe C:\WINNT\system32\notepad.exe C:\WINNT\system32\notepad.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\HijackThis.exe R3 - Default URLSearchHook is missing O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O3 - Toolbar: GMX Toolbar - {2D1DDD38-CE4D-459b-A01C-F11BC92D5B69} - C:\Programme\Gmx\GMX Toolbar\toolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [intell32.exe] C:\WINNT\System32\intell32.exe O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O20 - AppInit_DLLs: C:\WINNT\System32\sqlkhpm.dll O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programme\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programme\Panda Software\Panda Antivirus Platinum\pavsrv50.exe So, der Tag geht, intel32.exe blieb. Gute Nacht für heute. Die sq.... Datei lässt sich wegen seiner Größe nicht durchleuchten und hier darstellen in dem von Dir angegebenen Virusfound link... Andy Dieser Beitrag wurde am 02.08.2005 um 00:47 Uhr von Hippie editiert.
|
|
|
|
|
|
|
02.08.2005, 00:51
Member
Beiträge: 17 |
#22
Hier der letzte Escan Bericht: Mit einer wininet. datei als infiziert....
File C:\WINNT\system32\WININET.dll infected by "Virus.Win32.Nsag.b" Virus! Action Taken: No Action Taken. Object "Hijack Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "ISTSvc Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "ISTSvc Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "DyFuCA Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "DyFuCA Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "SideFind Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AdTools Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Power scan Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "ameopt Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Roings Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "adtools Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "ISTsvc Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\access_special.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\AdToolsX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\WinadX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\ysbactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\inst2.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\internazionale_ver10.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\ITDetector.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\PPSDKActiveXScanner.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\sl.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdCtlX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\WinTaskAdX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\vbiewer.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebUncoated.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AppleRGB.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\ColorMatchRGB.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleCoated.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\EuroscaleUncoated.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\JapanStandard.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\sRGB Color Space Profile.icm". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedCoated.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USSheetfedUncoated.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\USWebCoatedSWOP.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Recommended\AdobeRGB1998.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\WideGamutRGB.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\NTSC1953.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\PAL_SECAM.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\SMPTE-C.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\CIERGB.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop5DefaultCMYK.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Adobe\Acrobat 5.0\TempICCProfiles\Profiles\Non-Recommended\Photoshop4DefaultCMYK.icc". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe\Photoshop Album\Kataloge\My Catalog.psa". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\Gemeinsame Dateien\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\RealArcadeRdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\WinadX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\System32\vbiewer.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinAdCtlX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\WinTaskAdX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\sl.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\YSBactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ITDetector.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\access_special.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\inst2.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\AdManCtlX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\AdToolsX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaTicketsInstaller.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\ISTactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\internazionale_ver10.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\CONFLICT.1\ysbactivex.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\PPSDKActiveXScanner.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINNT\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0054F4EE-9A54-47F8-BDB8-3FB747D0059E}" refers to invalid object "C:\WINNT\System32\mddknb.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{03A94962-9DF7-4ACE-A885-3E5C71DF891D}" refers to invalid object "C:\WINNT\System32\gbealoa.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0553551A-DDA6-4260-B545-5F3044C8882A}" refers to invalid object "C:\WINNT\System32\omfn.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0A5F8451-E204-4933-8D14-1B8B50C9E3BB}" refers to invalid object "C:\WINNT\System32\poph.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{26EBD9DC-24D5-4779-B6F7-BF263091728F}" refers to invalid object "C:\WINNT\System32\dgch.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{276EF59C-B55B-4A2D-AAC4-BA23C23ABE75}" refers to invalid object "C:\WINNT\System32\bgmd.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2A125652-5359-408E-A1AD-F289207847D0}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2CB0B121-5E9E-4B59-B00D-C2D5B84A33B6}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{2E541280-07AF-4FBC-A657-6583B7453416}" refers to invalid object "C:\WINNT\System32\mcgn.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{39BE9181-0C1F-4EA3-A8A2-93C6C9C66287}" refers to invalid object "C:\WINNT\System32\cpfgo.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3C8116EA-0209-468C-8F3C-28C157ED4B2C}" refers to invalid object "C:\WINNT\System32\poph.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{49F774AE-AA80-43B2-B080-5089EE02B863}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6BFFC078-0D8B-48F6-A532-A5B76F7873B5}" refers to invalid object "C:\WINNT\System32\aodn.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{771A1334-6B08-4a6b-AEDC-CF994BA2CEBE}" refers to invalid object "C:\WINNT\DOWNLO~1\YSBACT~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{7B88A9DA-9D84-4085-AE5E-0AB5B4020168}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8150DB39-F2A5-4D9F-9816-ABE5F6A21BDB}" refers to invalid object "C:\WINNT\System32\jild.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{850486BA-85D9-41AB-B941-B3715105541E}" refers to invalid object "C:\WINNT\System32\hmbg.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8D3E8259-C86C-4803-879F-E5592AEFAD58}" refers to invalid object "C:\WINNT\System32\iml.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8F6770E1-6CD4-4D75-B151-CE5B284074E5}" refers to invalid object "C:\WINNT\System32\iafk.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A1ACF3EE-0859-497D-9978-4207D6CC6ABA}" refers to invalid object "C:\WINNT\System32\jaeek.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A2B25BF3-F983-478D-BF4D-8BBA397EEE94}" refers to invalid object "C:\WINNT\System32\klee.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A4383BB8-BDF5-436D-A56B-97815256516A}" refers to invalid object "C:\WINNT\System32\iml.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A4845882-333F-11D0-B724-00AA0062CBB7}" refers to invalid object "C:\WINNT\System32\WBEM\WBEMSTUB.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A660FE50-C65E-4F9A-8F3B-CA4A2CAFBC04}" refers to invalid object "C:\WINNT\System32\jkjii.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A8701B43-35AD-4386-A2F1-BB1D2631E95E}" refers to invalid object "C:\WINNT\System32\fhpkea.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B5DD9A64-5C4B-4a48-BE56-97C1A8F85708}" refers to invalid object "C:\WINNT\System32\fastvideoplayer.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BB876D9B-FD9A-4B8A-91AF-035CA10220EB}" refers to invalid object "C:\WINNT\System32\aplf.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{BE4ED391-2174-4F52-B1CA-94025A7FFE6F}" refers to invalid object "C:\WINNT\System32\afhk.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C66758C8-F7F4-4E8D-B6F4-1C495CAA8986}" refers to invalid object "C:\WINNT\System32\kmfl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C7C19DF2-8C12-4454-833C-C0BE68451899}" refers to invalid object "C:\WINNT\System32\ikci.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D2047107-B96A-4497-9ED8-92D8984F8E22}" refers to invalid object "C:\WINNT\System32\aplf.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{D249C888-F345-4A61-A341-78E679C8FA56}" refers to invalid object "C:\WINNT\System32\dnjo.dll". Action Taken: No Action Taken. |
|
|
|
|
|
|
02.08.2005, 00:54
Ehrenmitglied
Beiträge: 29434 |
#23
Zitat Sabina postete __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.08.2005, 01:16
Member
Beiträge: 17 |
#24
2MFIX find log 1.02b
These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "1&1 Internet AG by USt"="IEAK" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Eigenschaften fr Multimediadatei" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-Scannerverwaltung" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS-Sicherheit" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE-Eigenschaftenseite fr Dokumente" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell-Erweiterungen fr Freigaben" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL-Erweiterung" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung fr Grafikkarten" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung fr Bildschirme" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="CPL-Erweiterung fr Anzeigeverschiebung" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS-Sicherheit" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell-Datenauszughandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Erweiterung fr Datentr„gerkopien" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell-Erweiterungen fr Microsoft Windows-Netzwerkobjekte" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-Monitorverwaltung" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-Druckerverwaltung" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell-Erweiterungen fr die Dateikomprimierung" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Shellerweiterung fr Webdrucker" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontextmen fr die Verschlsselung" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Aktenkoffer" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Erweiterung fr HyperTerminal-Icons" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Schriftarten" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-Profil" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Druckersicherheit" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell-Erweiterungen fr Freigaben" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shellerweiterungen fr Windows Script Host" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Krypto-PKO-Erweiterung" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Krypto-Sign-Erweiterung" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netzwerk- und DFš-Verbindungen" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Geplante Tasks" "{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder" "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="Arbeitsplatz" "{86747AC0-42A0-1069-A2E6-08002B30309D}"="Aktenkoffer" "{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Ordnerverknpfung" "{12518493-00B2-11d2-9FA5-9E3420524153}"="Bereitgestellter Datentr„ger" "{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension" "{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page" "{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook" "{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service" "{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service" "{13709620-C279-11CE-A49E-444553540000}"="Shell Automationsdienst" "{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View" "{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Startmen" "{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service" "{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service" "{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler" "{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions" "{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop" "{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension" "{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon" "{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag & Drop-Hilfe" "{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Verschlsselungselemente zu den Kontextmens im Explorer hinzufgen" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder" "{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band" "{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu" "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site" "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft URL-Verlauf-Dienst" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Verlauf" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Sucheingriff" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite-Begráungsbildschirm" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX-Cacheordner" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Miniaturansicht" "{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor" "{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Syntaxanalyse der Adressleiste" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-Band" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channeldatei" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channelverknpfung" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channelhandlerobjekt" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Nach Personen..." "{65756541-C65C-11CD-0000-4B656E696100}"="Panda Antivirus" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: |
|
|
|
|
|
|
02.08.2005, 01:19
Ehrenmitglied
Beiträge: 29434 |
#25
na, wo bleibt denn der Rest von 2MFIX find?????????????????
__________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.08.2005, 01:25
Member
Beiträge: 17 |
#26
2Mfix 1.02b
Running From: C:\soybot\2mfix\l2mfix RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (ID-NI) ALLOW Read VORDEFINIERT\Benutzer (ID-IO) ALLOW Read VORDEFINIERT\Benutzer (ID-NI) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-IO) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-NI) ALLOW Full access VORDEFINIERT\Administratoren (ID-IO) ALLOW Full access VORDEFINIERT\Administratoren (ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access ERSTELLER-BESITZER Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Denying C access for really "Everyone" - adding new ACCESS DENY entry Registry Permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (CI) DENY --C------- Jeder (ID-NI) ALLOW Read VORDEFINIERT\Benutzer (ID-IO) ALLOW Read VORDEFINIERT\Benutzer (ID-NI) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-IO) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-NI) ALLOW Full access VORDEFINIERT\Administratoren (ID-IO) ALLOW Full access VORDEFINIERT\Administratoren (ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access ERSTELLER-BESITZER Setting up for Reboot Starting Reboot! C:\soybot\2mfix\l2mfix System Rebooted! Running From: C:\soybot\2mfix\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 860 'explorer.exe' Killing PID 860 'explorer.exe' Error 0x5 : Zugriff verweigert Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Error, Cannot find a process with an image name of rundll32.exe Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Zipping up files for submission: adding: clear.reg (92 bytes security) (deflated 2%) adding: echo.reg (92 bytes security) (deflated 9%) adding: direct.txt (92 bytes security) (deflated 8%) adding: lo2.txt (92 bytes security) (deflated 71%) adding: readme.txt (92 bytes security) (deflated 49%) adding: report.txt (92 bytes security) (deflated 62%) adding: test.txt (92 bytes security) (stored 0%) adding: test2.txt (92 bytes security) (stored 0%) adding: test3.txt (92 bytes security) (stored 0%) adding: test5.txt (92 bytes security) (stored 0%) adding: backregs/shell.reg (92 bytes security) (deflated 74%) Restoring Registry Permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for really "Everyone" Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (ID-NI) ALLOW Read VORDEFINIERT\Benutzer (ID-IO) ALLOW Read VORDEFINIERT\Benutzer (ID-NI) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-IO) ALLOW Read VORDEFINIERT\Hauptbenutzer (ID-NI) ALLOW Full access VORDEFINIERT\Administratoren (ID-IO) ALLOW Full access VORDEFINIERT\Administratoren (ID-NI) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access NT-AUTORITŽT\SYSTEM (ID-IO) ALLOW Full access ERSTELLER-BESITZER Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332 The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 The following are the files found: **************************************************************************** Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] **************************************************************************** Desktop.ini Contents: **************************************************************************** **************************************************************************** Logfile of HijackThis v1.99.1 Scan saved at 01:27:13, on 02.08.2005 Platform: Windows 2000 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\Programme\ewido\security suite\ewidoctrl.exe C:\Programme\ewido\security suite\ewidoguard.exe C:\Programme\Panda Software\Panda Antivirus Platinum\pavsrv50.exe C:\WINNT\system32\regsvc.exe C:\Programme\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\System32\mspmspsv.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINNT\System32\intell32.exe C:\WINNT\explorer.exe C:\WINNT\system32\NOTEPAD.EXE C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINNT\System32\cmd.exe C:\WINNT\system32\NOTEPAD.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\HijackThis.exe O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O3 - Toolbar: GMX Toolbar - {2D1DDD38-CE4D-459b-A01C-F11BC92D5B69} - C:\Programme\Gmx\GMX Toolbar\toolbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [intell32.exe] C:\WINNT\System32\intell32.exe O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O20 - AppInit_DLLs: C:\WINNT\System32\sqlkhpm.dll O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programme\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programme\Panda Software\Panda Antivirus Platinum\pavsrv50.exe hier das Scanergebnis von dem Ewido. Jetzt aber ins Bett.... Scanergebnis: HKLM\SOFTWARE\Classes\CLSID\{357A87ED-3E5D-437d-B334-DEB7EB4982A3} -> Trojan.Agent.eo : Gesäubert mit Backup HKLM\SOFTWARE\Classes\CLSID\{771A1334-6B08-4a6b-AEDC-CF994BA2CEBE} -> Spyware.YourSiteBar : Gesäubert mit Backup HKLM\SOFTWARE\Classes\CLSID\{DF4779D9-9B9D-A7D9-2322-3649432D4B58} -> Spyware.CoolWebSearch : Gesäubert mit Backup HKLM\SOFTWARE\Classes\IETLBAss.DOMP -> Spyware.CoolWebSearch : Gesäubert mit Backup HKLM\SOFTWARE\Classes\IETLBAss.DOMP\CLSID -> Spyware.CoolWebSearch : Gesäubert mit Backup HKLM\SOFTWARE\Classes\IETLBAss.DOMP\CurVer -> Spyware.CoolWebSearch : Gesäubert mit Backup HKLM\SOFTWARE\Classes\Interface\{12E919BC-C70F-432B-B831-1180DE734505} -> Dialer.Generic : Gesäubert mit Backup HKLM\SOFTWARE\Classes\Interface\{66BD1BD0-3655-42E4-8CE9-16D3613B0B25} -> Dialer.Generic : Gesäubert mit Backup HKLM\SOFTWARE\Classes\Interface\{AA4939C3-DECA-4A48-A454-97CD587C0EF5} -> Spyware.ISTBar : Gesäubert mit Backup HKLM\SOFTWARE\Classes\Interface\{EEE4A2E5-9F56-432F-A6ED-F6F625B551E0} -> Dialer.Generic : Gesäubert mit Backup HKLM\SOFTWARE\Classes\MediaAccX.Installer -> Spyware.WinAd : Gesäubert mit Backup HKLM\SOFTWARE\Classes\MediaAccX.Installer\CLSID -> Spyware.WinAd : Gesäubert mit Backup HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Gesäubert mit Backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\AMeOpt -> Spyware.InternetOptimizer : Gesäubert mit Backup HKLM\SOFTWARE\Preview AdService -> Spyware.BlazeFind : Gesäubert mit Backup HKLM\SOFTWARE\SearchRelevancy -> Spyware.SearchRelevancy : Gesäubert mit Backup HKLM\SOFTWARE\SearchRelevancy\Update -> Spyware.SearchRelevancy : Gesäubert mit Backup [1284] C:\WINNT\System32\intell32.exe -> Trojan.Small.ev : Gesäubert mit Backup C:\WINNT\cdplayer.ini:srrxs -> TrojanDownloader.Agent.an : Gesäubert mit Backup C:\WINNT\Downloaded Program Files\CONFLICT.1\MediaTicketsInstaller.ocx -> Spyware.MediaTickets : Gesäubert mit Backup C:\WINNT\hh.exe:kgdhc -> TrojanDownloader.Agent.bq : Gesäubert mit Backup C:\WINNT\IsUninst.exe:otria -> TrojanDownloader.Agent.bq : Gesäubert mit Backup C:\WINNT\ModemDet.txt:uqejx -> TrojanDownloader.Agent.bq : Gesäubert mit Backup C:\WINNT\secure1l.html:kxlsc -> TrojanDownloader.Agent.cd : Gesäubert mit Backup C:\WINNT\TASKMAN.EXE:crbgz -> TrojanDownloader.WinShow.ak : Gesäubert mit Backup C:\WINNT\twunk_32.exe:anjnk -> Trojan.Feat.2 : Gesäubert mit Backup C:\WINNT\unin0407.exe:mtiin -> TrojanDownloader.WinShow.ak : Gesäubert mit Backup C:\WINNT\wininit.ini:dnser -> TrojanDownloader.Agent.bq : Gesäubert mit Backup Dieser Beitrag wurde am 02.08.2005 um 01:41 Uhr von Hippie editiert.
|
|
|
|
|
|
|
02.08.2005, 10:37
Ehrenmitglied
Beiträge: 29434 |
#27
Hallo@Hippie
1. Öffne notepad (editor) Unter Start/Ausführen den Befehl notepad eingeben,bestätigen,dann erscheit ein notepad editor. Oder unter Start/Programme/Zubehör/Editor 2. Kopiere diesen Code rein: Zitat @ECHO OFF3. Speichere die Datei als Rem.bat auf Desktop 4. Doppel klick auf diese Datei Rem.bat #öffne das HijackThis-->> Button "scan" -->> Häkchen setzen -->> Button "Fix checked" -->> PC neustarten R3 - Default URLSearchHook is missing O4 - HKLM\..\Run: [intell32.exe] C:\WINNT\System32\intell32.exe O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O20 - AppInit_DLLs: C:\WINNT\System32\sqlkhpm.dll PC neustarten Start--> Ausfuehren--> cmd--> kopiere die Eintraege bis zum 15.01.2005 raus reinkopieren: cd\ cd %windir%\system32 dir /a:-d /o:-d > %systemdrive%\system32.txt start %systemdrive%\system32.txt cls exit + poste das neue Log vom HijackThis --------------------------------------------------------------------------- INFO: O4 - HKCU\..\Run: [Azecphl] C:\WINDOWS\System32\?ti2evxx.exe __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
03.08.2005, 09:20
Member
Beiträge: 17 |
#28
Hallo Sabina,
also ich war jetzt soweit, den vorletzten Eintrag abgearbeitet zu haben. Der HJT-log sah sehr kurz aus und enthielt wie immer die crazywinngs und sobald ich eine Datei öffne, öffnet sich auch das rote Ausrufezeichen von intell32.exe. Leider komme ich jetzt überhaupt nicht mehr ins Internet von meinem laptop aus, sondern erhalte nur noch einen blauen Bildschirm mit allen möglichen Zahlen und "bitte wenden sie sich an ihren Systemadministrator". Das mit dem notepad, etc. kann ich ja noch probieren, aber einen log kann ich - da ich ja keine Internetverbindung aufbauen kann - nicht posten. Macht es da überhaupt noch Sinn, weiter zu probieren oder sollte ich mir meine wichtigsten Dateien auf eine Diskette sichern und einfach (????, ich werde meinen Onkel anrufen) ein Betriebssystem komplett neu aufspielen? :-((( Andi |
|
|
|
|
|
|
03.08.2005, 09:35
Ehrenmitglied
Beiträge: 29434 |
#29
Zitat [1284] C:\WINNT\System32\intell32.exe -> Trojan.Small.ev : Gesäubert mit Backupeigentlich muesste das Problem behoben sein, ich bin auch ein wenig ratlos, vor allem, dass du nicht mehr ins Net kommst. Ich vermute, dass es mit dem loeschen von wininet.dll zu tun hat. Diese Datei, wenn infiziert, darf nicht so einfach geloescht werden, sondern mit einer "sauberen" ersetzt. Aber irgendwie hat sie ein Tool, wahrscheinlich der escan schon ins Nirvana befoerdert, bevor ich reagieren konnte...... suche folgendes: C:\WINDOWS\SYSTEM32\DLLCACHE Im "DLLCACHE" suche die wininet.dll -- rechtsklick-->Kopieren gehe zurück in -- C:\WINDOWS\System32 -- Rechtsklick -- Einfügen (somit müsstest du wieder eine "saubere" wininet.dll im System32-Ordner haben --------------------------------------------------------------------------- gehe in den abgesicherten Modus und loesche rigeros: (erst mit der bat-Datei und dann suche noch einmal manuell) C:\WINNT\System32\sqlkhpm.dll C:\WINNT\System32\intell32.exe C:\WINNT\System32\?ti2evxx.exe falls das alles nichts bringt.....ja, da muss formatiert werden....schade eigentlich, ich dachte, wir bekommen das alles wieder hin. Berichte, bitte wie es gelaufen ist. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
03.08.2005, 10:16
Member
Beiträge: 17 |
#30
Danke jedenfalls für die schnelle und gute Hilfe,
ich werde das evtl. gleich heute abend umsetzen/testen und berichten. Andi |
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
C:\WINNT\System32\intell32.exe
Gehe in den abgesicherten Modus und führe dort HJT aus. lasse folgende Einträge von HJT fixen:
O4 - HKLM\..\Run: [intell32.exe] C:\WINNT\System32\intell32.exe
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O20 - AppInit_DLLs: C:\WINNT\System32\sqlkhpm.dll
O20 - Winlogon Notify: tcpGDC - C:\WINNT\SYSTEM32\tcpGDC.dll
Führe dort weiterhin eScan aus. Der sollte Dir dann alle Viren/Malware auflisten, die er gefunden hat (beachte, dass nicht alles, was er findet, auch Viren sind bzw. Malware ist).
Wenn alles gut läuft, dann findet er lediglich die intell32.exe (allerdings kommt ein Virus selten allein) sowie C:\WINNT\System32\sqlkhpm.dll und C:\WINNT\SYSTEM32\tcpGDC.dll. Starte das Programm Killbox, aktiviere "Delete on Restart" und füge per Copy&Paste die Dateipfade der zu löschenden Dateien dort ein. Du wirst bei der ersten Datei gefragt, ob der Neustart sofort durchgeführt werden soll. Das verneine, sondern klicke erst auf "yes" nachdem Du die letzte Datei in die Liste eingefügt hast. Beim nächsten Systemstart werden die Dateien gelöscht.
Nach dem Neustart mal ein HJT-Log erstellen und hier posten, damit wir sehen können, ob es geholfen hat.
__________
Dies ist eine Signatur! Persönlicher Service: Du kommst aus Berlin? Dann melde Dich per PN bei mir, evtl. können wir einen Termin vereinbaren.
Der Grabsteinschubser