Desktop.hijacker.afcore.h

#16 Hi Sabina,

auf die Seite Virus-protect.net komme ich nicht, Fehlermeldung kann nicht geöffnet werden und Vorgang abgebrochen. ich versuch das Programm Silentrunner so zu finden. Habe jetzt aber noch etwas von gestern. Bitte antworte darauf, damit ich weiter posten kann, wenn ich was habe.

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 8033-0DE6

Verzeichnis von C:\WINDOWS\system32

25.10.2005 11:24 13.002 wpa.dbl
05.10.2005 09:36 2.301.792 MRT.exe
28.09.2005 23:29 693.248 DivX.dll
28.09.2005 23:29 688.128 divx_xx07.dll
28.09.2005 23:29 688.128 divx_xx0c.dll
28.09.2005 23:29 671.744 divx_xx11.dll
16.09.2005 22:17 733.184 divxdec.ax
13.09.2005 18:11 3.119 qtplugin.log
08.09.2005 16:49 86.016 dpl100.dll
08.09.2005 16:49 589.824 dpuGUI11.dll
08.09.2005 16:49 200.704 dtu100.dll
08.09.2005 16:49 315.392 dpus11.dll
08.09.2005 16:49 57.344 dpv11.dll




KASPERSKY ON-LINE SCANNER REPORT
Tuesday, October 25, 2005 13:54:01
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 25/10/2005
Kaspersky Anti-Virus database records: 146713
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\

Scan Statistics:
Total number of scanned objects: 28273
Number of viruses found: 1
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 5637 sec

Infected Object Name - Virus Name
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP77\A0034202.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP77\A0034209.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP78\A0035206.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP78\A0035213.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP80\A0035326.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP80\A0035334.sys Infected: Backdoor.Win32.HacDef.bj
C:\System Volume Information\_restore{07F882C9-6FC8-4AB6-92CD-DA51E9DD72BB}\RP80\A0035358.sys Infected: Backdoor.Win32.HacDef.bj

Scan process completed.

#17 silentrunners
http://virus-protect.org/silentrunner.html
http://www.silentrunners.org/sr_download.html
gehe auf:
Zitat:
Click here to download a zip file.
hier die Erklaerung:
http://www.silentrunners.org/sr_scriptuse.html
klicke: output file is in text format. --> Doppelklick und es oeffnet sich der Editor-->
und poste alles, was angezeigt wird.
__________
MfG Sabina

rund um die PC-Sicherheit

#18 Ist es das hier?

"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"BlockAds" = (empty string)
"Tweak-XP" = (empty string)
"TransparentIcons" = (empty string)
"H/PC Connection Agent" = ""C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]
"MsnMsgr" = ""C:\Programme\MSN Messenger\MsnMsgr.Exe" /background" [MS]
"9caf7d75497" = "C:\WINDOWS\System32\9caf7d75497.exe" [** WMI GetObject error **]

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -trayboot" ["ICQ Ltd."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AOLDialer" = "C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe" ["America Online, Inc"]
"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"ICQ Lite" = "C:\Programme\ICQLite\ICQLite.exe -minimize" ["ICQ Ltd."]
"RealTray" = "C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER" ["RealNetworks, Inc."]
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_04\bin\jusched.exe" ["Sun Microsystems, Inc."]
"9caf7d75497" = "C:\WINDOWS\System32\9caf7d75497.exe" [** WMI GetObject error **]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll" [MS]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\MSN Apps\MSN Toolbar\01.02.4000.1001\de\msntb.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{8992CF7B-FCE6-4E0B-BFA7-06A6645BDE50}" = "AB-Edit Context Menu Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\AB-Edit\ABEdMenu.dll" ["Oliver Grahl Software Design"]

HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\
"load" = (value not set)
"run" = (value not set)

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Buhl Data Service GmbH\DSL Virus Killer 2005\bdshelxt.dll" [file not found]
ContMenu\(Default) = "{8992CF7B-FCE6-4E0B-BFA7-06A6645BDE50}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\AB-Edit\ABEdMenu.dll" ["Oliver Grahl Software Design"]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
BitDefender Antivirus v8\(Default) = "{D653647D-D607-4DF6-A5B8-48D2BA195F7B}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Buhl Data Service GmbH\DSL Virus Killer 2005\bdshelxt.dll" [file not found]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Group Policies [Description]:
-----------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
HIJACK WARNING! "ForceActiveDesktopOn"=dword:00000001
[enables Active Desktop and prevents disabling it]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop enabled via Group Policy.

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Dokumente und Einstellungen\Marc\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"

Active Desktop web content:

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\
"FriendlyName" = ""
"Source" = "C:\DOKUME~1\Marc\LOKALE~1\Temp\9ff64641d.html"
"SubscribedURL" = "C:\DOKUME~1\Marc\LOKALE~1\Temp\9ff64641d.html"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "Marc" & "All Users" startup folders:
------------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"AOL 9.0 Tray-Symbol" -> shortcut to: "C:\Programme\AOL 9.0\aoltray.exe -check" ["America Online, Inc."]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = "ICQ Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "MSN" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\MSN Apps\MSN Toolbar\01.02.4000.1001\de\msntb.dll" [MS]

"{EB740041-E2A0-4346-A4DF-F2AFF42AB23D}" = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "n9cpw.dll" [file not found]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" = "ICQ Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]

"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "0"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\MSN Apps\MSN Toolbar\01.02.4000.1001\de\msntb.dll" [MS]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBC}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll" ["Sun Microsystems, Inc."]

{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F}\
"ButtonText" = "Mobilen Favoriten erstellen"
"CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Microsoft ActiveSync\INetRepl.dll" [MS]

{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F}\
"MenuText" = "Mobilen Favoriten erstellen..."
"CLSIDExtension" = "{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Microsoft ActiveSync\INetRepl.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Recherchieren"

{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\Programme\AIM95\aim.exe" ["America Online, Inc."]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{855F3B16-6D32-4fe6-8A56-BBB695989046}" = "ICQ Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQToolbar\toolbaru.dll" ["ICQ Inc."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AOL Connectivity Service, AOL ACS, ""C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe"" ["America Online, Inc."]
Machine Debug Manager, MDM, ""C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE"" [MS]
SmartLinkService, SLService, "slserv.exe" [" "]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 145 seconds, including 14 seconds for message boxes)

#19 Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fixme.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden.

Zitat

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_9CAF7D75497SVR]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\SafeBoot\Minimal\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_9CAF7D75497SVR]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\9caf7d75497svr]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_9CAF7D75497SVR]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\9caf7d75497svr]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"9caf7d75497"=-

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"9caf7d75497"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=-
"System"=""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoViewContextMenu"=-
"NoActiveDesktop"=-
"ForceActiveDesktopOn"=-

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]

KILLBOX
http://virus-protect.org/killbox.html
Delete File on Reboot -- anhaken
reinkopieren:

C:\DOKUME~1\Marc\LOKALE~1\Temp\9ff64641d.html
C:\\Recycler\Q678341.exe
C:\WINDOWS\9caf7d75497svr.sys
C:\WINDOWS\9caf7d75497.ini
C:\WINDOWS\System32\n9cpw.dll
C:\WINDOWS\System32\9caf7d75497.exe

und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"


PC neustarten
Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken).
Die Datei "fixme.reg" auf dem Desktop doppelklicken.

CCleaner (loesche alle temporaeren Dateien)
http://virus-protect.org/temp.html

dann scanne noch mal mit RegSrch.vbs (9caf7d75497svr)
und poste, was noch angezeigt wird
__________
MfG Sabina

rund um die PC-Sicherheit

#20 Hi Sabina!
Du bist ein Schatz! :-))
Alle äusserlichen Unannehmlichkeiten sind weg, d.h. der Hintergrund auf dem Desktop normal, als auch die Explorerseiten! und keine dämlichen Error Meldungen und sonstiger Schei...! Hier noch der Post nach dem scan mit Regsrch. Vielleicht ist ja noch was versteckt... !? :-))

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "9caf7d75497svr" 27.10.2005 02:07:06

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_9CAF7D75497SVR]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_9CAF7D75497SVR\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_9CAF7D75497SVR\0000]
"Service"="9caf7d75497svr"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_9CAF7D75497SVR]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_9CAF7D75497SVR\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_9CAF7D75497SVR\0000]
"Service"="9caf7d75497svr"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_9CAF7D75497SVR]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_9CAF7D75497SVR\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_9CAF7D75497SVR\0000]
"Service"="9caf7d75497svr"

#21 Hallo@tomjuli

start --> Ausfuehren--> regedit

bearbeiten--> suchen--> 9CAF7D75497SVR


HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_9CAF7D75497SVR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_9CAF7D75497SVR
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_9CAF7D75497SVR

Sollte man Probleme haben, die Einträge zu löschen,
Legacy_ .....kann nicht gelöscht werden. Fehler beim Löschen des Schlüssels,
dann gehe mit Rechtsklick im Kontextmenü auf: "Berechtigungen" Setze das Häkchen bei "Vollzugriff zulassen"
Übernehmen, OK
Danach sollte(n) sich der(die) betreffenden Schlüssel löschen lassen.
__________
MfG Sabina

rund um die PC-Sicherheit

#22 Hi Sabina,

habe ich gemacht und gelöscht, wobei nur 2 aufgetreten sind, die ich löschen musste.
War das jetzt alles?

:-)

LG Tom

#23

Zitat

tomjuli postete
Hi Sabina,

habe ich gemacht und gelöscht, wobei nur 2 aufgetreten sind, die ich löschen musste.
War das jetzt alles?

:-)

LG Tom

im Grunde muesste der PC sauber sein, deaktiviere noch die Systemwiederherstellung, dann aktiviere sie wieder.
dann scanne noch mal (zum Ueberpruefen mit zwei oder drei Onlinescannern)
http://virus-protect.org/onlinescan.html
__________
MfG Sabina

rund um die PC-Sicherheit