hclean ballon,hgqhp.exe, NameServer = 195.95.218.35,85.255.112.11

#76 loesche mit der Killbox:

C:\WINDOWS\System32\dmpxl.exe
C:\WINDOWS\System32\TFTP2128

PC neustarten

F-Secure:scane noch mal
__________
MfG Sabina

rund um die PC-Sicherheit

#77 Hallo Sabina,
Dateien sind gelöscht und F-secure findet nix mehr, oder?

F-Secure scan:

09/18/05 09:49:48 [Info]: BlackLight Engine 1.0.23 initialized
09/18/05 09:49:48 [Info]: OS: 5.1 build 2600 (Service Pack 1)
09/18/05 09:49:48 [Note]: 4019 0
09/18/05 09:49:48 [Note]: 4019 1
09/18/05 09:49:48 [Note]: 4019 2
09/18/05 09:49:48 [Note]: 4019 3
09/18/05 09:49:48 [Note]: 4019 4
09/18/05 09:49:48 [Note]: 4005 0
09/18/05 09:49:54 [Note]: 4006 0
09/18/05 09:49:54 [Note]: 4011 1408
09/18/05 09:49:54 [Note]: FSRAW library version 1.7.1011
09/18/05 10:01:24 [Note]: 4007 0


Gruß
Oliver

#78 sieht gut aus

poste bitte das neue Log vom HijackThis und vom Silentrunner (und berichte, ob es noch Warnungen von deinem Virenscanner gibt)
__________
MfG Sabina

rund um die PC-Sicherheit

#79 Hallo Sabina,
mein Virenscanner bringt keine Meldunge mehr, sollte es das gewesen sein?
Wäre echt erleichtert, da ich vorher schon an Neuinstallation dachte.
Vorab schon mal ein riesen Dank an Dich für die Unterstützung.


Logfile of HijackThis v1.99.1
Scan saved at 13:24:12, on 18.09.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\htpatch.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\Dit.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe
C:\Programme\Medion\PowerCinema\PCMService.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\DitExp.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\ewido\security suite\ewidoctrl.exe
C:\Programme\ewido\security suite\ewidoguard.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Dokumente und Einstellungen\Oliver\Eigene Dateien\Programme\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [PCMService] C:\Programme\Medion\PowerCinema\PCMService.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Copy Location - C:\WINDOWS\WEB\graburl.htm
O9 - Extra button: (no name) - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINDOWS\System32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to R&estricted Zone - {B06300D0-CCDE-11d2-92D3-0000F87A4A55} - C:\WINDOWS\System32\webzone.dll
O9 - Extra button: (no name) - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINDOWS\System32\webzone.dll
O9 - Extra 'Tools' menuitem: Add to Tr&usted Zone - {BF80219A-CCDD-11d2-92D3-0000F87A4A55} - C:\WINDOWS\System32\webzone.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Offline - {FC09D8A3-C85A-11d2-92D0-0000F87A4A55} - C:\WINDOWS\System32\oline.dll
O9 - Extra button: MedionShop - {01E9CF82-AE9D-42BA-A629-B23D51A4B86B} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com/
O15 - Trusted Zone: http://www.t-online.de
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126637636218
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BC916F8A-2FE8-4840-8161-3ABE7729D489}: NameServer = 217.237.151.161 217.237.151.33
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe




"Silent Runners.vbs", revision 40.1, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"HTpatch" = "C:\WINDOWS\htpatch.exe" [null data]
"VOBRegCheck" = "C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg" [null data]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"NeroCheck" = "C:\WINDOWS\System32\\NeroCheck.exe" ["Ahead Software Gmbh"]
"Microsoft Works Update Detection" = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" ["Microsoft® Corporation"]
"Dit" = "Dit.exe" [null data]
"ATIPTA" = "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"ccApp" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"SSC_UserPrompt" = "C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation"]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"AVG7_CC" = "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP" ["GRISOFT, s.r.o."]
"RealTray" = "C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER" ["RealNetworks, Inc."]
"ToADiMon.exe" = "C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart" ["Marmiko IT-Solutions GmbH"]
"PCMService" = "C:\Programme\Medion\PowerCinema\PCMService.exe" [empty string]
"AVGCtrl" = ""C:\Programme\AVPersonal\AVGNT.EXE" /min" ["H+BEDV Datentechnik GmbH"]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{8b15971b-5355-4c82-8c07-7e181ea07608}\(Default) = "Fax"
\StubPath = "rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser" [MS]
{94de52c8-2d59-4f1b-883e-79663d2d9a8c}\(Default) = "Fax Provider"
\StubPath = "rundll32.exe C:\WINDOWS\System32\Setup\FxsOcm.dll,XP_UninstallProvider" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx" [empty string]
{9ECB9560-04F9-4bbc-943D-298DDF1699E1}\(Default) = "Norton Internet Security"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{F5D92341-0A64-11D0-9956-0000E8096023}" = "CD Copy Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shellext\CDWshext.dll" ["VoB Computersysteme GmbH"]
"{F5D92342-0A64-11D0-9956-0000E8096023}" = "CD Wizard Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shellext\CDWshext.dll" ["VoB Computersysteme GmbH"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}" = "AVG7 Find Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ewido\security suite\context.dll" ["ewido networks"]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ewido\security suite\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AVG7 Shell Extension\(Default) = "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Grisoft\AVG Free\avgse.dll" ["GRISOFT, s.r.o."]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\scrnsave.scr" [MS]


Startup items in "Oliver" & "All Users" startup folders:
--------------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS]


Enabled Scheduled Tasks:
------------------------

"Norton AntiVirus - Meinen Computer prüfen - Oliver" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
"Symantec NetDetect" -> launches: "C:\Programme\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]

"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" = "Norton Internet Security"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll" ["Symantec Corporation"]

"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKCU\Software\Microsoft\Internet Explorer\Extensions\
{01E9CF82-AE9D-42BA-A629-B23D51A4B86B}\
"ButtonText" = "MedionShop"
"Exec" = "http://www.medionshop.de/" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"


Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.medion.com/

Missing lines (compared with English-language version):
[Strings]: 1 line


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir Update, AVWUpSrv, ""C:\Programme\AVPersonal\AVWUPSRV.EXE"" ["H+BEDV Datentechnik GmbH, Germany"]
AVG7 Alert Manager Server, Avg7Alrt, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe" ["GRISOFT, s.r.o."]
AVG7 Update Service, Avg7UpdSvc, "C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe" ["GRISOFT, s.r.o."]
ewido security suite control, ewido security suite control, "C:\Programme\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
ewido security suite guard, ewido security suite guard, "C:\Programme\ewido\security suite\ewidoguard.exe" ["ewido networks"]
ISSvc, ISSVC, "C:\Programme\Norton Internet Security\ISSVC.exe" ["Symantec Corporation"]
Machine Debug Manager, MDM, ""C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"" [MS]
Norton AntiVirus Auto-Protect-Dienst, navapsvc, ""C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Symantec Core LC, Symantec Core LC, "C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Network Drivers Service, SNDSrvc, "C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe" ["Symantec Corporation"]
Symantec Network Proxy, ccProxy, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
Symantec SPBBCSvc, SPBBCSvc, "C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe" ["Symantec Corporation"]
X10 Device Network Service, x10nets, "C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe" ["X10"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 50 seconds, including 8 seconds for message boxes)



Gruß
Oliver

#80 Hallo@Oliver

ja, der PC ist sauber, soweit ich das aus der Ferne beurteilen kann. Ich waere dir aber sehr verbunden, damit du hier nicht "Dauerkunde" wirst, die WindowsUpdates zu laden (SP2) und falls das im Moment nicht moeglich ist, alles zu tun, damit es moeglich ist

Alles Gute fuer dich + PC

Gruss
Sabina
__________
MfG Sabina

rund um die PC-Sicherheit

#81 Hallo Sabina,
SP2 und allen anderen Updates vom MS sind jetzt drauf. Der Mensch ist schon komisch, erst durch Schaden wird man klug ;-). Keine Sorge, weder ich noch alle anderen hier im Forum haben die Absicht euch nochmal zur Last zu fallen.
Trotzdem werde ich in euerm Forum weiterhin rumstöbern, da ich es echt klasse finde und mit so einer schnellen Lösung meines Problems nie im Leben gerechnet hätte. Nochmal vielen Dank.

Gruß
Oliver

#82 Hallo,

ich habe genau das gleiche Problem. Antivir meldet hclean32.exe und rdsndin.exe. Dann kommt immer der Ballon. Ich habe die Dateien alle schon mal gelöscht. Am nächsten Tag waren meine "Freunde" wieder da. Ich vermute, dass sie sich irgendwo verstecken. Die Systemwiederherstellung habe ich deaktiviert. Es wäre toll wenn mir jemand mir helfen könnte. Anbei mein Hijackthis Log:

Logfile of HijackThis v1.99.1
Scan saved at 23:20:07, on 09.01.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\ATI Technologies\ATI Systemsteuerung\atiptaxx.exe
C:\Programme\T-DSL SpeedManager\SpeedMgr.exe
D:\Programme\PestPatrol\PPMemCheck.exe
D:\Programme\PestPatrol\CookiePatrol.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGNT.EXE
D:\active sync\WCESCOMM.EXE
C:\Programme\Logitech\Profiler\lwemon.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\T-DSL SpeedManager\tsmsvc.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\ElsterFormular2004\Elfo2004.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\GMX Programme\GMX Internet Manager\GMX_Internet_Manager.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\DOKUME~1\Gerrit\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://top-find4u.com/sp.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mediamarkt.de

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://top-find4u.com/sp.htm
R3 - URLSearchHook: (no name) - {ED96668E-E3C9-3FB0-C854-03B99E5DD2A2} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe
O1 - Hosts: 207.68.176.190 auto.search.msn.com
O1 - Hosts: 207.68.176.190 www.auto.search.msn.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [AtiPTA] C:\Programme\ATI Technologies\ATI Systemsteuerung\atiptaxx.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [PPMemCheck] D:\Programme\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\Programme\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels32.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\active sync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Programme\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Office\Office10\OSA.EXE
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~2\Office\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\active sync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\active sync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\active sync\INetRepl.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.saturn.de
O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127429677812

O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128182161796
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{085415A2-AEF5-4105-9A45-4417FB781DEE}: NameServer = 217.237.149.161 217.237.151.225
O17 - HKLM\System\CCS\Services\Tcpip\..\{367AE45E-FDCF-4396-8F80-97DB0248EC19}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F975842-78C6-4869-9B35-56FFFF66F04B}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{7950C6C4-AB69-40A3-A949-451A151BDB7F}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6E1BD35-1A70-4DE5-8237-0FC9A10F707A}: NameServer = 195.95.218.3,85.255.112.5
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\System32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

#83 gerritb

Download f-secure-Beta Trial
http://www.f-secure.com/blacklight/
doppelklick: blbeta.exe
nach den Check klicke --> next
(suche die textdatei vom scan auf dem Desktop und poste sie mir)

poste alle 4 Logs + Pfadangabe --> 3 Monate vom Datum her genuegen
http://virus-protect.org/datfindbat.html

rkfiles.zip
http://skads.org/special/rkfiles.zip
-->entpacken-->
gehe in den abgesicherten Modus
http://www.tu-berlin.de/www/software/virus/savemode.shtml
-->Doppelklick(Ausfuehren)-->rkfiles.bat--> warten bis sich
das DOS-Fenster schliesst--->poste C:\log.txt

winpfind
http://virus-protect.org/winpfind.html
__________
MfG Sabina

rund um die PC-Sicherheit

#84 Hallo Sabina,

also los gehts:

01/10/06 20:22:09 [Info]: BlackLight Engine 1.0.30 initialized
01/10/06 20:22:09 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/10/06 20:22:09 [Note]: 7019 4
01/10/06 20:22:09 [Note]: 7005 0
01/10/06 20:22:37 [Note]: 7006 0
01/10/06 20:22:37 [Note]: 7011 1136
01/10/06 20:22:38 [Note]: FSRAW library version 1.7.1014
01/10/06 20:23:26 [Info]: Hidden file: C:\Programme\T-DSL SpeedManager\TDSLTest.exe
01/10/06 20:23:26 [Note]: 10002 1
01/10/06 20:23:57 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
01/10/06 20:23:57 [Note]: 10002 1
01/10/06 20:24:07 [Info]: Hidden file: C:\WINDOWS\system32\favme.exe
01/10/06 20:24:07 [Note]: 10002 1
01/10/06 20:24:09 [Info]: Hidden file: C:\WINDOWS\system32\loadctr32.exe
01/10/06 20:24:09 [Note]: 10002 1
01/10/06 20:24:11 [Info]: Hidden file: C:\WINDOWS\system32\dmyfv.exe
01/10/06 20:24:11 [Note]: 10002 1
01/10/06 20:24:12 [Info]: Hidden file: C:\WINDOWS\system32\hclean32.exe
01/10/06 20:24:12 [Note]: 10002 1
01/10/06 20:24:14 [Info]: Hidden file: C:\WINDOWS\system32\ntfsnlpa.exe
01/10/06 20:24:14 [Note]: 10002 1
01/10/06 20:24:17 [Info]: Hidden file: C:\WINDOWS\system32\csgpv.exe
01/10/06 20:24:17 [Note]: 7002 32
01/10/06 20:24:17 [Note]: 7003 1
01/10/06 20:24:17 [Note]: 10002 1
01/10/06 20:25:26 [Note]: 7007 0

Verzeichnis von C:\WINDOWS\system32

10.01.2006 22:37 35.870 vsconfig.xml
10.01.2006 22:35 873 mmf.sys
09.01.2006 22:05 2.206 wpa.dbl
29.12.2005 03:54 280.064 gdi32.dll
21.12.2005 01:07 374.064 perfh009.dat
21.12.2005 01:07 50.532 perfc009.dat
21.12.2005 01:07 384.216 perfh007.dat
21.12.2005 01:07 61.096 perfc007.dat
21.12.2005 01:07 853.572 PerfStringBackup.INI
17.12.2005 15:33 4.212 zllictbl.dat
08.12.2005 16:25 2.723.680 MRT.exe
03.12.2005 15:22 198.552 FNTCACHE.DAT
01.12.2005 04:31 1.492.480 shdocvw.dll
24.11.2005 00:58 3.013.632 mshtml.dll
24.11.2005 00:58 1.022.464 browseui.dll
15.11.2005 00:51 71.440 zlcommdb.dll
15.11.2005 00:51 79.624 zlcomm.dll
15.11.2005 00:51 100.104 vsxml.dll
15.11.2005 00:51 382.728 vsutil.dll
15.11.2005 00:51 71.440 vsregexp.dll
15.11.2005 00:50 227.088 vspubapi.dll
15.11.2005 00:50 104.208 vsmonapi.dll
15.11.2005 00:50 141.064 vsinit.dll
15.11.2005 00:50 372.816 vsdatant.sys
15.11.2005 00:50 83.720 vsdata.dll
15.11.2005 00:34 54.960 vsutil_loc0407.dll
05.11.2005 04:16 606.208 urlmon.dll
05.11.2005 04:16 1.056.256 danim.dll
21.10.2005 04:40 664.064 wininet.dll
21.10.2005 04:40 474.112 shlwapi.dll
21.10.2005 04:40 39.424 pngfilt.dll
21.10.2005 04:40 530.944 mstime.dll
21.10.2005 04:40 146.432 msrating.dll
21.10.2005 04:40 448.512 mshtmled.dll
21.10.2005 04:40 96.768 inseng.dll
21.10.2005 04:40 205.312 dxtrans.dll
21.10.2005 04:40 55.808 extmgr.dll
21.10.2005 04:40 152.064 cdfview.dll
21.10.2005 04:40 251.392 iepeers.dll
20.10.2005 23:25 1.094.144 esent.dll
13.10.2005 00:11 15.584 spmsg.dll
06.10.2005 04:08 1.839.616 win32k.sys
05.10.2005 21:30 249 spupdwxp.log

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F881-9C03

Verzeichnis von C:\DOKUME~1\Gerrit\LOKALE~1\Temp

10.01.2006 22:39 2.621 WcesView.log
10.01.2006 22:36 16.384 ~DF96CE.tmp
10.01.2006 22:35 224 WCESCOMM.LOG
10.01.2006 16:09 59.964 ~e5.0001
10.01.2006 16:08 16.384 ~DFB907.tmp
10.01.2006 14:53 16.384 ~DF8FD0.tmp
10.01.2006 07:16 16.384 ~DF9D6E.tmp
10.01.2006 01:29 16.384 ~DFAC63.tmp
10.01.2006 00:03 16.384 ~DFB016.tmp
09.01.2006 23:36 16.384 ~DF49A0.tmp
09.01.2006 23:03 0 c365_appcompat.txt
09.01.2006 22:58 16.384 ~DF7681.tmp
09.01.2006 22:54 56 kbdummy.5
09.01.2006 22:54 56 kbdummy.4
09.01.2006 22:49 16.384 ~DF685A.tmp
09.01.2006 22:38 56 kbdummy.3
09.01.2006 22:38 56 kbdummy.2
09.01.2006 22:36 16.384 ~DF5692.tmp
09.01.2006 22:33 56 kbdummy.1
09.01.2006 22:33 56 kbdummy.0
09.01.2006 22:25 16.384 ~DFEA59.tmp
09.01.2006 22:16 16.384 ~DFF16E.tmp
09.01.2006 22:15 16.384 ~DF6D2B.tmp
09.01.2006 22:09 16.384 ~DF71B9.tmp
09.01.2006 22:06 16.384 ~DF76C2.tmp
08.01.2006 20:45 16.384 ~DF9E31.tmp
08.01.2006 17:22 16.384 ~DF76A4.tmp
08.01.2006 17:03 16.384 ~DFB761.tmp
08.01.2006 14:34 16.384 ~DFCA59.tmp
06.01.2006 02:37 717 control.xml
06.01.2006 02:31 16.384 ~DFAE0.tmp
06.01.2006 02:16 16.384 ~DFD26B.tmp
06.01.2006 02:14 16.384 ~DFE2E1.tmp
06.01.2006 02:00 16.384 ~DF630B.tmp
06.01.2006 01:48 16.384 ~DFBE6F.tmp
06.01.2006 01:29 16.384 ~DFAB31.tmp
05.01.2006 23:39 16.384 ~DF2851.tmp
05.01.2006 01:33 16.384 ~DF2B91.tmp
04.01.2006 23:18 16.384 ~DF383D.tmp
04.01.2006 17:59 16.384 ~DFA0A5.tmp
03.01.2006 15:49 11.410 avp.klb
03.01.2006 15:49 17.323 daily.avc
03.01.2006 13:41 340.480 MWAVReg.EXE
03.01.2006 13:33 335.872 esupdate.exe
03.01.2006 13:10 377.920 mwavscan.com
03.01.2006 13:02 1.021 daily-ex.avc
03.01.2006 11:45 146.571 spydb.avs
03.01.2006 02:31 49.909 base082.avc
03.01.2006 01:38 2.711 mwav.ini
02.01.2006 14:48 7.850 Chinese.con
02.01.2006 14:48 10.559 Finnish.con
02.01.2006 14:48 11.729 Polish.con
02.01.2006 14:48 11.462 French.con
02.01.2006 14:48 10.866 Spanish.con
02.01.2006 14:48 10.884 Spanishl.con
02.01.2006 14:48 10.528 Romanian.con
02.01.2006 14:48 11.380 Portuguese.con
02.01.2006 14:48 10.015 Italian.con
02.01.2006 14:48 13.831 German.con
01.01.2006 22:23 16.384 ~DF40CF.tmp
01.01.2006 18:51 10.181 config.lan
01.01.2006 18:51 10.181 English.con
01.01.2006 17:40 84.024 virus016.avc
01.01.2006 17:40 144.983 unp026.avc
01.01.2006 17:40 61.922 unp014.avc
01.01.2006 17:40 77.379 virus012.avc
01.01.2006 17:40 50.725 unp001.avc
01.01.2006 17:40 61.884 unp005.avc
01.01.2006 17:40 54.541 unp003.avc
01.01.2006 17:40 9.939 unp000.avc
01.01.2006 17:40 107.729 troj034.avc
01.01.2006 17:40 50.197 troj020.avc
01.01.2006 17:40 56.594 troj022.avc
01.01.2006 17:40 50.858 troj014.avc
01.01.2006 17:40 6.313 smart.avc
01.01.2006 17:40 101.737 troj005.avc
01.01.2006 17:40 14.254 mail.avc
01.01.2006 17:40 50.875 krnexe32.avc
01.01.2006 17:40 21.655 fa.avc
01.01.2006 17:40 50.032 ext005.avc
01.01.2006 17:40 48.017 ext003.avc
01.01.2006 17:40 47.828 ext004.avc
01.01.2006 17:40 65.683 base084.avc
01.01.2006 17:40 69.599 ca.avc
01.01.2006 17:40 50.680 base081.avc
01.01.2006 17:40 49.911 base083.avc
01.01.2006 17:40 50.429 base080.avc
01.01.2006 17:40 50.463 base078.avc
01.01.2006 17:40 50.160 base079.avc
01.01.2006 17:40 62.320 base077.avc
01.01.2006 17:40 1.568 avp.set
01.01.2006 17:40 49.303 base005.avc
01.01.2006 16:27 16.384 ~DFC457.tmp
01.01.2006 16:11 16.384 ~DF9D4B.tmp
01.01.2006 15:55 3.608 netfxupdate.log
01.01.2006 15:55 10.988 netfxsl.log
01.01.2006 13:15 16.384 ~DFA068.tmp
30.12.2005 18:25 122.880 msvlclnt.dll
30.12.2005 18:23 41.024 Getvlist.exe
29.12.2005 20:02 1.008 000E11D4.key
29.12.2005 20:02 1.028 000E11D5.key
26.12.2005 17:11 27.111 unp004.avc
26.12.2005 17:11 48.048 ext002.avc
26.12.2005 14:57 98.304 MWAVL.exe
23.12.2005 18:21 71.758 unp002.avc
23.12.2005 17:55 36.112 Chinese.Age
23.12.2005 17:55 45.078 Finnish.Age
23.12.2005 17:55 48.144 Polish.Age
23.12.2005 17:55 47.920 French.Age
23.12.2005 17:55 48.423 Spanish.Age
23.12.2005 17:55 48.162 Spanishl.Age
23.12.2005 17:55 44.019 Romanian.Age
23.12.2005 17:55 47.565 Portuguese.Age
23.12.2005 17:55 55.627 Italian.Age
23.12.2005 17:55 58.136 German.Age
22.12.2005 13:20 218.098 troj033.avc
22.12.2005 13:02 4.059 Chinese.dow
21.12.2005 21:37 70.910 unp016.avc
21.12.2005 21:37 93.982 troj031.avc
20.12.2005 18:02 78.450 virus011.avc
20.12.2005 18:02 83.998 krnunp.avc
19.12.2005 14:37 491.008 Download.exe
19.12.2005 10:45 5.907 Polish.dow
18.12.2005 06:01 363.520 viewtcp.exe
18.12.2005 05:54 1.694 ViewTcp.lan
18.12.2005 05:54 1.694 English.tcp
17.12.2005 13:55 99.916 troj009.avc
15.12.2005 18:51 42.372 English.Age
15.12.2005 18:51 42.372 language.ini
14.12.2005 13:41 5.753 Spanishl.dow
12.12.2005 15:41 48.372 base006.avc
12.12.2005 15:41 63.298 base007.avc
09.12.2005 13:42 80.084 unp019.avc
08.12.2005 16:47 49.098 ext001.avc
07.12.2005 18:23 50.388 troj016.avc
07.12.2005 16:39 51.435 troj025.avc
07.12.2005 16:39 29.619 gen004.avc
06.12.2005 16:10 5.523 German.dow
06.12.2005 14:30 32.826 krnexe.avc
06.12.2005 14:30 36.526 virus020.avc
05.12.2005 11:35 100.027 troj007.avc
04.12.2005 14:53 1.737 German.tcp
01.12.2005 18:18 5.306 Finnish.dow
01.12.2005 18:18 5.768 French.dow
01.12.2005 18:18 5.766 Spanish.dow
01.12.2005 18:18 5.371 Romanian.dow
01.12.2005 18:18 5.710 Portuguese.dow
01.12.2005 18:18 5.393 Italian.dow
01.12.2005 15:31 5.108 English.dow
01.12.2005 14:45 1.841 Polish.tcp
25.11.2005 17:29 1.718 Spanish.tcp
25.11.2005 17:29 1.718 Spanishl.tcp
25.11.2005 17:25 1.895 Portuguese.tcp
25.11.2005 17:24 1.718 Italian.tcp
25.11.2005 17:23 1.886 French.tcp
25.11.2005 17:19 1.750 Finnish.tcp
23.11.2005 22:25 188.662 unp025.avc
23.11.2005 22:25 37.093 unp012.avc
18.11.2005 19:32 29.097 unp021.avc
18.11.2005 19:32 44.623 unp018.avc
18.11.2005 19:32 28.752 krnengn.avc
18.11.2005 19:32 14.008 kernel.avc
18.11.2005 12:01 7.187 Polish.lic
17.11.2005 13:10 62.198 unp015.avc
17.11.2005 13:10 92.411 krnmacro.avc
10.11.2005 15:11 81.196 unp007.avc
10.11.2005 15:11 34.528 unp024.avc
10.11.2005 15:11 56.430 unp006.avc
07.11.2005 16:36 73.725 virus003.avc
07.11.2005 16:36 109.301 troj003.avc
02.11.2005 13:21 113.508 krn001.avc
26.10.2005 11:22 50.124 troj013.avc
21.10.2005 17:33 1.397 Chinese.tcp
21.10.2005 16:36 50.224 worm001.avc
21.10.2005 16:36 68.829 unp010.avc
21.10.2005 16:36 43.378 troj027.avc
21.10.2005 16:36 41.440 troj028.avc
21.10.2005 16:36 50.443 troj018.avc
11.10.2005 11:05 74.103 virus010.avc
08.10.2005 17:35 52.101 unp009.avc
08.10.2005 17:35 48.724 troj030.avc
06.10.2005 21:25 7.414 English.lic
06.10.2005 21:25 7.414 license.txt
06.10.2005 10:42 50.654 unp022.avc
04.10.2005 11:20 47.070 troj026.avc

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F881-9C03

Verzeichnis von C:\WINDOWS

10.01.2006 22:42 1.273.501 WindowsUpdate.log
10.01.2006 22:36 0 0.log
10.01.2006 22:35 2.048 bootstat.dat
10.01.2006 20:26 32.564 SchedLgU.Txt
10.01.2006 15:56 3.325 tm.ini
10.01.2006 15:36 6.400 balloon.wav
10.01.2006 01:13 0 Lic.xxx
10.01.2006 01:07 518.212 ntbtlog.txt
06.01.2006 02:37 271.651 wmsetup.log
06.01.2006 01:53 96.811 iis6.log
06.01.2006 01:53 107.727 ntdtcsetup.log
06.01.2006 01:53 175.044 comsetup.log
06.01.2006 01:53 1.355 imsins.log
06.01.2006 01:53 21.732 ocmsn.log
06.01.2006 01:53 253.572 tsoc.log
06.01.2006 01:53 11.004 KB912919.log
06.01.2006 01:53 326.379 ocgen.log
06.01.2006 01:53 31.471 msgsocm.log
06.01.2006 01:53 614.627 FaxSetup.log
06.01.2006 01:53 397.609 setupapi.log
06.01.2006 01:53 29.308 updspapi.log
06.01.2006 01:27 16.084 MKDEMSG.LOG
06.01.2006 00:51 1.536 MKDEWE.TRN
21.12.2005 01:10 1.456 COM+.log
17.12.2005 15:46 1.393 imsins.BAK
17.12.2005 15:46 10.974 KB910437.log
17.12.2005 15:46 16.747 KB905915.log
03.12.2005 14:44 45 setupact.log
15.11.2005 23:10 11.894 KB896424.log
04.11.2005 01:42 4.204 ModemLog_Creatix V.92 HAM Data Fax Modem.txt
28.10.2005 21:31 41 tdf.dii
25.10.2005 23:52 22.693 KB901017.log
25.10.2005 23:52 25.080 KB902400.log
25.10.2005 23:51 15.618 KB896688.log
25.10.2005 23:50 14.827 KB905414.log
25.10.2005 23:50 14.469 KB900725.log
25.10.2005 23:49 12.139 KB904706.log
25.10.2005 23:49 14.567 KB905749.log
15.10.2005 16:09 4.827 SYMEVENT.LOG
08.10.2005 16:12 22.992 KB896727.log
08.10.2005 16:10 13.269 KB894391.log
08.10.2005 16:03 10.057 KB885250.log
08.10.2005 16:03 10.095 KB887742.log
08.10.2005 16:03 9.678 KB887472.log
08.10.2005 16:03 5.890 KB886185.log
08.10.2005 16:01 3.359 KB885884.log
06.10.2005 17:47 797 Active Setup Log.txt
06.10.2005 17:46 32.548 KB896727-IE6SP1-20050719.165959.log
06.10.2005 00:32 795 Active Setup Log.BAK
05.10.2005 22:25 44 WININIT.INI
05.10.2005 21:46 29.224 spupdsvc.log
05.10.2005 21:41 731 DtcInstall.log
05.10.2005 21:37 316.640 WMSysPr9.prx
05.10.2005 21:31 940.135 setuplog.txt
04.10.2005 01:23 2.026 OEWABLog.txt
04.10.2005 01:15 612.590 svcpack.log
04.10.2005 01:14 228.165 KB901214.log
04.10.2005 01:12 231.207 KB899591.log
04.10.2005 01:10 230.502 KB899588.log
04.10.2005 01:08 231.505 KB899587.log
04.10.2005 01:06 225.333 KB896428.log
04.10.2005 01:05 231.680 KB896423.log
04.10.2005 01:03 226.086 KB896422.log
04.10.2005 01:01 229.686 KB896358.log
04.10.2005 01:00 230.544 KB893756.log
04.10.2005 00:58 230.099 KB893086.log
04.10.2005 00:55 226.997 KB893066.log
04.10.2005 00:53 219.866 KB891781.log
04.10.2005 00:51 235.179 KB890859.log
04.10.2005 00:49 229.645 KB890046.log
04.10.2005 00:46 219.346 KB888302.log
04.10.2005 00:43 219.704 KB888113.log
04.10.2005 00:41 218.528 KB885836.log
04.10.2005 00:39 229.122 KB885835.log
04.10.2005 00:37 216.833 KB873339.log
04.10.2005 00:35 224.424 KB873333.log
04.10.2005 00:25 200 cmsetacl.log
04.10.2005 00:23 7.285 sessmgr.setup.log
03.10.2005 22:05 0 setuperr.log
03.10.2005 21:51 416 WINNT32.LOG
03.10.2005 21:51 403 DHCPUPG.LOG
03.10.2005 21:46 1.517 UPGRADE.TXT
03.10.2005 21:45 148 wsdu.log
01.10.2005 18:02 20.701 KB898458.log
01.10.2005 17:57 716 win.ini
01.10.2005 17:51 1.352 xpsp1hfm.log
01.10.2005 17:51 16.985 KB835732.log
01.10.2005 17:47 10.351 KB828741.log
01.10.2005 17:45 2.068 vminst.log

Datentr„ger in Laufwerk C: ist BOOT
Volumeseriennummer: F881-9C03

Verzeichnis von C:\

10.01.2006 22:47 0 sys.txt
10.01.2006 22:46 11.568 system.txt
10.01.2006 22:45 13.713 systemtemp.txt
10.01.2006 22:42 109.595 system32.txt
10.01.2006 22:35 267.964.416 hiberfil.sys
10.01.2006 22:35 402.653.184 pagefile.sys
10.01.2006 01:19 0 23990098.$$$
10.01.2006 01:19 4 AVPCallback.log
03.12.2005 17:19 4.322 TDSLCheck.txt
06.11.2005 20:25 134 LxDasi.Log
04.10.2005 00:25 211 boot.ini
03.10.2005 23:59 47.564 NTDETECT.COM
03.10.2005 23:59 251.184 ntldr

D:\hijackthis\rkfiles

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213
C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213

Files Found in all users startup Folder............
------------------------
Files Found in all users windows Folder............
------------------------
Finished
bye
»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...
PEC2 10.01.2006 23:36:52 679 C:\log.txt
PEC2 10.01.2006 23:28:14 216 C:\win.txt

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...

Items found in C:\WINDOWS\hosts


Checking %System% folder...
PEC2 18.08.2001 13:00:00 41118 C:\WINDOWS\SYSTEM32\dfrg.msc
PTech 29.08.2005 12:27:12 520968 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
PECompact2 08.12.2005 16:25:42 2723680 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 08.12.2005 16:25:42 2723680 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 04.08.2004 08:57:08 733696 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 04.08.2004 08:57:32 686592 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 18.08.2001 13:00:00 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...
PTech 04.08.2004 06:41:38 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
10.01.2006 22:57:56 S 2048 C:\WINDOWS\bootstat.dat
21.12.2005 00:56:36 RHS 227 C:\WINDOWS\assembly\Desktop.ini
10.01.2006 22:35:52 HS 873 C:\WINDOWS\system32\mmf.sys
10.01.2006 22:37:16 H 35870 C:\WINDOWS\system32\vsconfig.xml
17.12.2005 15:33:14 H 4212 C:\WINDOWS\system32\zllictbl.dat
01.12.2005 04:44:42 S 21633 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB905915.cat
02.12.2005 01:12:38 S 10925 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB910437.cat
03.01.2006 00:09:26 S 11223 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB912919.cat
10.01.2006 22:57:44 H 8192 C:\WINDOWS\system32\config\default.LOG
10.01.2006 22:58:12 H 1024 C:\WINDOWS\system32\config\SAM.LOG
10.01.2006 22:57:58 H 16384 C:\WINDOWS\system32\config\SECURITY.LOG
10.01.2006 23:32:22 H 180224 C:\WINDOWS\system32\config\software.LOG
10.01.2006 22:58:04 H 1138688 C:\WINDOWS\system32\config\system.LOG
01.01.2006 15:46:38 H 1024 C:\WINDOWS\system32\config\systemprofile\NTUSER.DAT.LOG
30.11.2005 23:21:58 HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\dce1821d-023f-40ad-9319-dabc37fe8ce5
30.11.2005 23:21:58 HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
10.01.2006 22:54:44 H 6 C:\WINDOWS\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 04.08.2004 08:58:22 70656 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 04.08.2004 08:58:22 555008 C:\WINDOWS\SYSTEM32\appwiz.cpl
11.05.2001 183808 C:\WINDOWS\SYSTEM32\bdeadmin.cpl
WIDCOMM, Inc. 15.09.2003 16:54:18 245819 C:\WINDOWS\SYSTEM32\btcpl.cpl
Microsoft Corporation 04.08.2004 08:58:22 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 04.08.2004 08:58:22 138240 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 04.08.2004 08:58:22 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 04.08.2004 08:58:22 157184 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 04.08.2004 08:58:22 359424 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 04.08.2004 08:58:22 133120 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 04.08.2004 08:58:22 381440 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 04.08.2004 08:58:22 69632 C:\WINDOWS\SYSTEM32\joy.cpl
Microsoft Corporation 18.08.2001 13:00:00 189440 C:\WINDOWS\SYSTEM32\main.cpl
AvantGo, Inc. 22.12.2003 17:28:10 69632 C:\WINDOWS\SYSTEM32\mbllnk.cpl
Microsoft Corporation 04.08.2004 08:58:22 625152 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 18.08.2001 13:00:00 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 04.08.2004 08:58:22 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 04.08.2004 08:58:22 260096 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 04.08.2004 08:58:22 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 04.08.2004 08:58:22 117248 C:\WINDOWS\SYSTEM32\powercfg.cpl
RealNetworks, Inc. 27.05.2002 12:53:04 25088 C:\WINDOWS\SYSTEM32\prefscpl.cpl
Apple Computer, Inc. 30.09.2004 17:03:44 324608 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 04.08.2004 08:58:22 303104 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 18.08.2001 13:00:00 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 04.08.2004 08:58:22 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 04.08.2004 08:58:22 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 26.05.2005 03:16:22 174872 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 18.08.2001 13:00:00 189440 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
Microsoft Corporation 18.08.2001 13:00:00 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 18.08.2001 13:00:00 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
09.05.2002 13:13:58 HS 84 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
20.07.2002 19:11:30 1554 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
09.05.2002 14:05:16 HS 62 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
09.05.2002 13:13:58 HS 84 C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
09.05.2002 14:05:16 HS 62 C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\desktop.ini
09.05.2002 14:34:36 80 C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\sversion.ini
31.12.2000 22:57:46 8192 C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\user52.rdb

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
=

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AntiVir/Win
{a7cda720-84ee-11d0-b5c0-00001b3ca278} = C:\Programme\AVPersonal\AVShlExt.DLL
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AntiVir/Win
{a7cda720-84ee-11d0-b5c0-00001b3ca278} = C:\Programme\AVPersonal\AVShlExt.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}
=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tipps und Tricks = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{08BEC6AA-49FC-4379-3587-4B21E286C19E} = :
= :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}
ButtonText = Mobilen Favoriten erstellen :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}
MenuText = Mobilen Favoriten erstellen... : d:\active sync\INetRepl.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CCA281CA-C863-46ef-9331-5C8D4460577F}
ButtonText = @btrez.dll,-4015 :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Programme\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer-Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\System32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
NeroCheck C:\WINDOWS\System32\NeroCheck.exe
AtiPTA C:\Programme\ATI Technologies\ATI Systemsteuerung\atiptaxx.exe
T-DSL SpeedMgr "C:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
PPMemCheck D:\Programme\PestPatrol\PPMemCheck.exe
CookiePatrol D:\Programme\PestPatrol\CookiePatrol.exe
Zone Labs Client C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
QuickTime Task "C:\Programme\QuickTime\qttask.exe" -atboottime
AVGCtrl C:\Programme\AVPersonal\AVGNT.EXE /min

RealTray C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
System C:\WINDOWS\system32\kernels32.exe
System C:\WINDOWS\system32\kernels32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
MSMSGS "C:\Programme\Messenger\msmsgs.exe" /background

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 145

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
DisableTaskMgr 0


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent
= Ati2evxx.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv
= wlnotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon
= wlnotify.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 10.01.2006 23:45:54

Ich hoffe, dass ich alles richtig gemacht habe.

Viele Grüsse
Gerrit

#85 gerritb

Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten --> kopiere das Ergebnis in das Sicherheitsforum
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\system32\mmf.sys

----------------------------------------------------------------------

Dann starte blacklight nochmal und lasse alle Dateien, die es anzeigt umbenennen

scan --> next none auf rename ändern

(ausser

Zitat

C:\Programme\T-DSL SpeedManager\TDSLTest.exe
C:\WINDOWS\system32\wbem\wbemtest.exe

Dann lass Blacklight den Rechner neu starten.

---------------------------------------------------------------------------

Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fixme.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden.

Zitat

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar]
"{08BEC6AA-49FC-4379-3587-4B21E286C19E}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser]
"{08BEC6AA-49FC-4379-3587-4B21E286C19E}"=-

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{08BEC6AA-49FC-4379-3587-4B21E286C19E}"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=-
"System"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System]
"DisableTaskMgr"=-

[-HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=-
"System"=""

KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

C:\WINDOWS\tm.ini
C:\WINDOWS\system32\kernels32.exe
C:\WINDOWS\balloon.wav
C:\WINDOWS\Lic.xxx
C:\WINDOWS\tdf.dii
C:\log.txt
C:\win.txt

Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken). Die Datei "fixme.reg" auf dem Desktop doppelklicken

öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://top-find4u.com/sp.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://top-find4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://top-find4u.com/sp.htm
R3 - URLSearchHook: (no name) - {ED96668E-E3C9-3FB0-C854-03B99E5DD2A2} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe
O1 - Hosts: 207.68.176.190 auto.search.msn.com
O1 - Hosts: 207.68.176.190 www.auto.search.msn.com
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels32.exe
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{367AE45E-FDCF-4396-8F80-97DB0248EC19}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F975842-78C6-4869-9B35-56FFFF66F04B}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{7950C6C4-AB69-40A3-A949-451A151BDB7F}: NameServer = 195.95.218.3,85.255.112.5
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6E1BD35-1A70-4DE5-8237-0FC9A10F707A}: NameServer = 195.95.218.3,85.255.112.5

PC neustarten

du musst eine neue Internetverbindung erstellen !!!!!!!!!!!!!!!!!

manuell mit den Zugangsdaten des Providers herstellen. Bei Netzwerk/Eigenschaften des Internetprotokolls steht denn auch IP und DNS automatisch beziehen.

Hoster.zip
http://www.funkytoad.com/download/hoster.zip
Press 'Restore Original Hosts' and press 'OK' Exit Program.

-------------------------------------------------------------------------------
Download FixWareout:
http://swandog46.geekstogo.com/Fixwareout.exe

Fixwareout.exe --> next --> Install --> Run fixit --> Finish / der PC wird neustarten --> C:\fixwareout\report.txt --> kopiere die Textdatei hier

---------------------------------------------------------------------------

Deaktivieren Wiederherstellung XP
Arbeitsplatz-->rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.

Panda - Onlinescan --> kopiere hier den scanreport
http://virus-protect.org/onlinescan.html
__________
MfG Sabina

rund um die PC-Sicherheit

#86 Hallo Sabina,

ich kann mich derzeit nicht in da Internet verbinden. Ich hoffe es ist nur ein Hardwareproblem. Oder meintest Du das mit "du musst eine neue Internetverbindung erstellen !!!!!!!!!!!!!!!!!".
Reicht dafür auch eine Neuinstallation der gmx - Software ?

MfG
Gerrit

#87 deine Internetverbindung wurde geloescht ...sie war vom Wareout "gekapert"

Zitat

inetnum: 195.95.218.0 - 195.95.219.255
netname: ESTHOST
descr: Inhoster hosting company
descr: OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine

Nun musst du eine neue erstellen.

manuell mit den Zugangsdaten des Providers herstellen.
oder:
Bei Netzwerk/Eigenschaften des Internetprotokolls steht denn auch IP und DNS automatisch beziehen.--> hake es an und starte den PC neu

eigentlich muesstest du noch ins netz kommen, denn das ist deine korrekte Verbindung
O17 - HKLM\System\CCS\Services\Tcpip\..\{085415A2-AEF5-4105-9A45-4417FB781DEE}: NameServer = 217.237.149.161 217.237.151.225
__________
MfG Sabina

rund um die PC-Sicherheit

#88 Hallo Sabina,

ich hatte probleme mit der Telekom. Ich hoffe, dass ich alles richtig gemacht habe. Insbesondere das mit der neuen Internetverbindung.
Der Onlinescan der mmf.sys hat leider nicht funktioniert. Gibt es eine andere möglichkeit ?

Fixwareout ver 1.003
Last edited 12/5/2005
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\10
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\11
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\12
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\14
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\17
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\19
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\20
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\pgtshlld
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nidnsdr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23naelch
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ytpme
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23lserspg
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\aplnsftn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23rtcdaol

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Search by size and names...
C:\WINDOWS\SYSTEM32\CSORPE~1.REN
C:\WINDOWS\SYSTEM32\DMYFVE~1.REN
C:\WINDOWS\SYSTEM32\LOADCT~1.REN
C:\WINDOWS\SYSTEM32\NTFSNL~1.REN

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

Der Panda-Scan läuft gerade. Poste ich dann sofort.

Ich hab da wohl was falsch gemacht. :-(

Incident Status Location

Spyware:spyware/wareout Not disinfected Windows Registry
Spyware:Cookie/Falkag Not disinfected C:\Dokumente und Einstellungen\Gerrit\Cookies\gerrit@as1.falkag[2].txt
Adware:Adware/QuickWeb Not disinfected C:\!KillBox\ntfsnlpa.exe
Spyware:Cookie/Falkag Not disinfected C:\Dokumente und Einstellungen\Gerrit\Cookies\gerrit@as1.falkag[2].txt
Virus:Trj/Qhost.DT Disinfected C:\Programme\AVPersonal\INFECTED\HCLEAN32.EXE.001
Virus:Trj/Qhost.DT Disinfected C:\Programme\AVPersonal\INFECTED\HCLEAN32.EXE.VIR
Adware:Adware/Findspy Not disinfected C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.001
Adware:Adware/Findspy Not disinfected C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.002
Adware:Adware/Findspy Not disinfected C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.VIR
Adware:Adware/QuickWeb Not disinfected C:\RECYCLER\NPROTECT\00228111.exe
Adware:Adware/QuickWeb Not disinfected C:\RECYCLER\NPROTECT\00228195.exe
Adware:Adware/QuickWeb Not disinfected C:\RECYCLER\NPROTECT\00228277.exe
Adware:Adware/QuickWeb Not disinfected C:\RECYCLER\NPROTECT\00228871.exe
Virus:Trj/DelCache.A Disinfected C:\WINDOWS\system32\csorp.exe.ren
Adware:Adware/QuickWeb Not disinfected C:\WINDOWS\system32\ntfsnlpa.exe.ren
Virus:Eicar.Mod Not disinfected D:\Programme\PestPatrol\Help.chm[HowCanITestDetection.html]
MfG

Gerrit

#89 gerritb

loesche manuell:

C:\!KillBox\ntfsnlpa.exe

loesche mit der Killbox:--> also alles reinkopieren

C:\WINDOWS\system32\csorp.exe.ren
C:\WINDOWS\system32\ntfsnlpa.exe.ren
C:\RECYCLER\NPROTECT\00228111.exe
C:\RECYCLER\NPROTECT\00228195.exe
C:\RECYCLER\NPROTECT\00228277.exe
C:\RECYCLER\NPROTECT\00228871.exe
C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.001
C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.002
C:\Programme\AVPersonal\INFECTED\RDSNDIN.EXE.VIR
VC:\Programme\AVPersonal\INFECTED\HCLEAN32.EXE.001
C:\Programme\AVPersonal\INFECTED\HCLEAN32.EXE.VIR

PC neustarten

scanne mit ewido und kopiere hier den scanreport
http://virus-protect.org/ewido.html
__________
MfG Sabina

rund um die PC-Sicherheit

#90 Hallo Sabina,

hier kommt der Report:

---------------------------------------------------------
ewido anti-malware - Scan Report
---------------------------------------------------------

+ Erstellt am: 21:17:56, 22.01.2006
+ Report-Checksumme: 7E25BE6

+ Scanergebnis:

C:\!KillBox\00228111.exe -> Spyware.Msnagent : Gesäubert mit Backup
C:\!KillBox\00228195.exe -> Spyware.Msnagent : Gesäubert mit Backup
C:\!KillBox\00228277.exe -> Spyware.Msnagent : Gesäubert mit Backup
C:\!KillBox\00228871.exe -> Spyware.Msnagent : Gesäubert mit Backup
C:\!KillBox\ntfsnlpa.exe -> Spyware.Msnagent : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Gerrit\Cookies\gerrit@as1.falkag[2].txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Gerrit\Cookies\gerrit@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Gesäubert mit Backup


::Report Ende

MfG

Gerrit