Trj/dnschanger.bd entfernen? ( Pipas.a )

#1 ich hatte in den letzten tagen einige probleme mit meinem rechner. 2 viren / trojaner konnte ich entfernen. norton & kaspersky finden nichts schädliches mehr. aber panda entdeckt den trojaner DNSCHANGER.BD (C://windows/system32/hgqhp.exe). Wie komme ich denn an den ran?
spybot findet bei mir regelmäßig noch Pipas.A ! kann ich zwar entfernen, aber nachdem ich online war isses wieder da. was ist das überhaupt? infos finde ich leider keine.

vielleicht kann mal jemand einen blick auf mein hijackThis werfen:

Logfile of HijackThis v1.97.7
Scan saved at 13:38:30, on 15.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Dokumente und Einstellungen\***\Eigene Dateien\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forum.bunker-dresden.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer bereitgestellt von Planetis
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O12 - Plugin for .mid: C:\Programme\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123330349390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123330331937
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

ERGÄNZUNG:

nach einem nochmaligen panda aktivescan ist der dnschanger.bd weg. hoffentlich bleibt es so!
hat trotzdem jemand eine ahnung, was Pipas.A ist?

#2 Nutzte bitte mal Blacklight http://www.f-secure.com/blacklight/try.shtml

Lade es herunter, entpacke es in einen extra Ordner, starte es, waehle folgendes, erst " i acept the agreement", dann "scan", warte bis es den Rechner geprueft hat, dann "next" und "exit". Es befindet sich nun eine TXT Datei in dem Ordner, in dem sich auch Blacklight befindet, post es bitte hier.
__________
MfG Ralf
SEO-Spam Hunter

#3 hi raman!

hier die textdatei:

12/16/05 21:32:41 [Info]: BlackLight Engine 1.0.30 initialized
12/16/05 21:32:41 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/16/05 21:32:42 [Note]: 7019 4
12/16/05 21:32:42 [Note]: 7005 0
12/16/05 21:33:09 [Note]: 7006 0
12/16/05 21:33:09 [Note]: 7011 796
12/16/05 21:33:09 [Note]: 7018 1908
12/16/05 21:33:09 [Info]: Hidden process: C:\WINDOWS\system32\idemlog.exe
12/16/05 21:33:09 [Note]: FSRAW library version 1.7.1014
12/16/05 21:33:58 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
12/16/05 21:33:58 [Note]: 10002 1
12/16/05 21:34:13 [Info]: Hidden file: C:\WINDOWS\system32\csygu.exe
12/16/05 21:34:13 [Note]: 7002 32
12/16/05 21:34:13 [Note]: 7003 1
12/16/05 21:34:13 [Note]: 10002 1
12/16/05 21:34:30 [Info]: Hidden file: C:\WINDOWS\system32\dmpgv.exe
12/16/05 21:34:30 [Note]: 7002 32
12/16/05 21:34:30 [Note]: 7003 1
12/16/05 21:34:30 [Note]: 10002 1
12/16/05 21:34:45 [Info]: Hidden file: C:\WINDOWS\system32\idemlog.exe
12/16/05 21:34:46 [Note]: 10002 1
12/16/05 21:34:59 [Info]: Hidden file: C:\WINDOWS\system32\favset.exe
12/16/05 21:34:59 [Note]: 10002 1
12/16/05 21:35:09 [Info]: Hidden file: C:\WINDOWS\system32\filesafer23.exe
12/16/05 21:35:10 [Note]: 10002 1
12/16/05 21:35:26 [Info]: Hidden file: C:\WINDOWS\system32\pppcgm.exe
12/16/05 21:35:26 [Note]: 10002 1
12/16/05 21:35:41 [Info]: Hidden file: C:\WINDOWS\system32\sphlp32.exe
12/16/05 21:35:42 [Note]: 10002 1
12/16/05 21:36:00 [Info]: Hidden file: C:\WINDOWS\system32\howiper.exe
12/16/05 21:36:00 [Note]: 10002 1
12/16/05 21:37:20 [Note]: 7007 0

#4 LAsse mit hilfe von Blacklight diese DAteien "rename"en:


C:\WINDOWS\system32\csygu.exe
C:\WINDOWS\system32\dmpgv.exe
C:\WINDOWS\system32\idemlog.exe
C:\WINDOWS\system32\favset.exe
C:\WINDOWS\system32\filesafer23.exe
C:\WINDOWS\system32\pppcgm.exe
C:\WINDOWS\system32\sphlp32.exe
C:\WINDOWS\system32\howiper.exe

Nach dem Neustart sind die DAteien mit der Erweiterung .ren SChicke diese bitte an virus@protecus.de und poste ein neues Log. BTW: Weisst du wo du dir diesen Hijacker eingefangen hast?
__________
MfG Ralf
SEO-Spam Hunter

#5 hi ralf!
hier mein neues log:

12/17/05 01:01:13 [Info]: BlackLight Engine 1.0.30 initialized
12/17/05 01:01:13 [Info]: OS: 5.1 build 2600 (Service Pack 2)
12/17/05 01:01:13 [Note]: 7019 4
12/17/05 01:01:13 [Note]: 7005 0
12/17/05 01:01:16 [Note]: 7006 0
12/17/05 01:01:16 [Note]: 7011 1380
12/17/05 01:01:17 [Note]: FSRAW library version 1.7.1014
12/17/05 01:02:03 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
12/17/05 01:02:03 [Note]: 10002 1
12/17/05 01:02:16 [Info]: Hidden file: C:\WINDOWS\system32\csmuk.exe
12/17/05 01:02:16 [Note]: 7002 32
12/17/05 01:02:16 [Note]: 7003 1
12/17/05 01:02:16 [Note]: 10002 1
12/17/05 01:02:27 [Info]: Hidden file: C:\WINDOWS\system32\dmhnu.exe
12/17/05 01:02:27 [Note]: 7002 32
12/17/05 01:02:27 [Note]: 7003 1
12/17/05 01:02:27 [Note]: 10002 1
12/17/05 01:02:41 [Info]: Hidden file: C:\WINDOWS\system32\idemlog.exe.ren
12/17/05 01:02:42 [Note]: 10002 1
12/17/05 01:02:54 [Info]: Hidden file: C:\WINDOWS\system32\favset.exe.ren
12/17/05 01:02:54 [Note]: 10002 1
12/17/05 01:03:06 [Info]: Hidden file: C:\WINDOWS\system32\filesafer23.exe.ren
12/17/05 01:03:06 [Note]: 10002 1
12/17/05 01:03:19 [Info]: Hidden file: C:\WINDOWS\system32\pppcgm.exe.ren
12/17/05 01:03:19 [Note]: 10002 1
12/17/05 01:03:33 [Info]: Hidden file: C:\WINDOWS\system32\sphlp32.exe.ren
12/17/05 01:03:34 [Note]: 10002 1
12/17/05 01:03:51 [Info]: Hidden file: C:\WINDOWS\system32\howiper.exe.ren
12/17/05 01:03:51 [Note]: 10002 1

wo ich mir das eingefangen habe? keine ahnung! einiges muß über eine russische seite gelaufen sein, aber das ist nur eine vermutung.

#6 Hm, da kommen wir mit Blacklight wohl nicht viel weiter. Poste bitte einen Silentrunner Report:

http://virus-protect.org/silentrunner.html
__________
MfG Ralf
SEO-Spam Hunter

#7 "Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"desktop" = "C:\WINDOWS\system32\idemlog.exe" [file not found]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AtiPTA" = "atiptaxx.exe" ["ATI Technologies, Inc."]
"EM_EXEC" = "C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" ["Logitech Inc. "]
"ccApp" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"ccRegVfy" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"]
"Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" ["HP"]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"Zone Labs Client" = "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"dmxxi.exe" = "C:\WINDOWS\system32\dmxxi.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL" [MS]
"{A0752120-6D75-D111-B5B1-0800095A2318}" = "HandyBits EasyCrypto Shell Extensions"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{32A9D769-5B55-4a25-9A62-86B5683FE50A}" = "NikonView Drop Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Nikon\NkView6\NkvDropExt.dll" ["Nikon Corporation"]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
INFECTION WARNING! "System" = "csqgm.exe" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
EasyCryptoMenu\(Default) = "{A0752120-6D75-D111-B5B1-0800095A2318}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
EasyCryptoMenu\(Default) = "{A0752120-6D75-D111-B5B1-0800095A2318}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\major\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmypics.scr" [MS]


Enabled Scheduled Tasks:
------------------------

"Symantec NetDetect" -> launches: "C:\Programme\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Norton AntiVirus Auto-Protect-Dienst, navapsvc, ""C:\Programme\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Norton Unerase Protection, NProtectService, ""C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
SymWMI Service, SymWSC, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]


Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = INFECTION WARNING! "Lkbdflt2" ["Logitech"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzlnt04\Driver = "hpzlnt04.dll" ["HP"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 42 seconds, including 13 seconds for message boxes)

#8 Kopiere den Inhalt zwischen den "--cut--" bitte in Notepad und speichere es bitte als fixroot.reg in einen Ordner ab. Dann ein doppelklick auf diese Datei. Du wirst vom System gefragt, ob du das in die Registrierung einfuegen moechtest. Beantworte das mit Ja. Dann starte bitte neu und poste ein aktuelles Hijackthis, Blacklight und Silentrunner log.

--cut--
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=-
"System"=""
--cut--
__________
MfG Ralf
SEO-Spam Hunter

#9 ich kann dem "fachchinesisch" zwar kaum was abgewinnen ;-), aber hier die neuen daten:

Logfile of HijackThis v1.97.7
Scan saved at 20:40:58, on 17.12.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\Dokumente und Einstellungen\major\Eigene Dateien\rootkit\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Outlook Express\msimn.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://forum.bunker-dresden.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer bereitgestellt von Planetis
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [dmdjl.exe] C:\WINDOWS\system32\dmdjl.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O12 - Plugin for .mid: C:\Programme\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mp3: C:\Programme\Internet Explorer\PLUGINS\npqtplugin4.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) - http://www.cyberlink.com/winxp/CheckDVD.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123330349390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123330331937
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab


"Silent Runners.vbs", revision 41, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"desktop" = "C:\WINDOWS\system32\idemlog.exe" [file not found]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AtiPTA" = "atiptaxx.exe" ["ATI Technologies, Inc."]
"EM_EXEC" = "C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE" ["Logitech Inc. "]
"ccApp" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"ccRegVfy" = ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"" ["Symantec Corporation"]
"Advanced Tools Check" = "C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE" ["Symantec Corporation"]
"Symantec NetDriver Monitor" = "C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer" ["Symantec Corporation"]
"NeroCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"HPDJ Taskbar Utility" = "C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" ["HP"]
"TkBellExe" = ""C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"Zone Labs Client" = "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"dmdjl.exe" = "C:\WINDOWS\system32\dmdjl.exe" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{BDF3E430-B101-42AD-A544-FADC6B084872}\(Default) = "NAV Helper"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL" [MS]
"{A0752120-6D75-D111-B5B1-0800095A2318}" = "HandyBits EasyCrypto Shell Extensions"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{32A9D769-5B55-4a25-9A62-86B5683FE50A}" = "NikonView Drop Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Nikon\NkView6\NkvDropExt.dll" ["Nikon Corporation"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
EasyCryptoMenu\(Default) = "{A0752120-6D75-D111-B5B1-0800095A2318}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
EasyCryptoMenu\(Default) = "{A0752120-6D75-D111-B5B1-0800095A2318}"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\tsseCryp.dll" [null data]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Symantec.Norton.Antivirus.IEContextMenu\(Default) = "{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\major\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssmypics.scr" [MS]


Enabled Scheduled Tasks:
------------------------

"Symantec NetDetect" -> launches: "C:\Programme\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" = "Norton AntiVirus"
-> {CLSID}\InProcServer32\(Default) = "C:\Programme\Norton AntiVirus\NavShExt.dll" ["Symantec Corporation"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Norton AntiVirus Auto-Protect-Dienst, navapsvc, ""C:\Programme\Norton AntiVirus\navapsvc.exe"" ["Symantec Corporation"]
Norton Unerase Protection, NProtectService, ""C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE"" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
SymWMI Service, SymWSC, ""C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe"" ["Symantec Corporation"]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]


Keyboard Driver Filters:
------------------------

HKLM\System\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\
"UpperFilters" = INFECTION WARNING! "Lkbdflt2" ["Logitech"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
hpzlnt04\Driver = "hpzlnt04.dll" ["HP"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 39 seconds, including 4 seconds for message boxes)

BLACKLIGHT findet ( für den moment ?! ) nichts mehr

#10 Das ist schon sehr gut. Fixe bitte im abgesicherten Modus folgendes:


O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O4 - HKLM\..\Run: [dmdjl.exe] C:\WINDOWS\system32\dmdjl.exe
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe


Der abgesicherte Modus ist wichtig, da sonst unter Umstaenden Spybots Teatimer dazwischen funkt.

Nun solltest du auch die ren DAteien sehen und schicken koennen.

Poste bitte noch alkle 4 TXT Dateien , die du mit datfind.bat erstellen musst:
http://virus-protect.org/datfindbat.html
__________
MfG Ralf
SEO-Spam Hunter

#11 Verzeichnis von C:\WINDOWS\system32

17.12.2005 23:53 31.767 vsconfig.xml
16.12.2005 21:10 2.206 wpa.dbl
15.12.2005 16:31 2.550 Uninstall.ico
15.12.2005 16:31 1.406 Help.ico
15.12.2005 16:31 1.718 Open.ico
15.12.2005 16:31 1.406 AddQuit.ico
15.12.2005 16:31 5.350 IE.ico
15.12.2005 16:31 9.470 Desktop.ico
15.12.2005 16:31 1.718 Quick.ico
15.12.2005 12:50 0 asfiles.txt
12.12.2005 17:25 4.984 close.bmp
12.12.2005 17:25 19.712 insurance.bmp
12.12.2005 17:25 11.772 spyware.bmp
12.12.2005 17:25 21.224 xxx.bmp
12.12.2005 17:25 21.872 pharmacy.bmp
12.12.2005 17:25 21.872 dating.bmp
12.12.2005 17:25 23.480 gambling.bmp
12.12.2005 01:47 51.200 cssaz.exe
01.12.2005 12:14 86.091 S32EVNT1.DLL
28.11.2005 19:29 149.200 FNTCACHE.DAT
25.11.2005 00:53 16.832 amcompat.tlb
25.11.2005 00:53 23.392 nscompat.tlb
25.11.2005 00:53 2.272 w95inf16.dll
25.11.2005 00:53 4.608 w95inf32.dll
13.11.2005 12:17 4.212 zllictbl.dat
30.10.2005 11:30 40.128 perfc009.dat
30.10.2005 11:30 311.740 perfh009.dat
30.10.2005 11:30 316.924 perfh007.dat
30.10.2005 11:30 48.354 perfc007.dat
30.10.2005 11:30 723.568 PerfStringBackup.INI
29.08.2005 19:09 71.424 zlcommdb.dll
29.08.2005 19:09 79.616 zlcomm.dll
29.08.2005 19:09 100.096 vsxml.dll
29.08.2005 19:09 382.720 vsutil.dll
29.08.2005 19:09 71.424 vsregexp.dll
29.08.2005 19:08 227.072 vspubapi.dll
29.08.2005 19:08 104.192 vsmonapi.dll
29.08.2005 19:08 141.056 vsinit.dll
29.08.2005 19:08 368.256 vsdatant.sys
29.08.2005 19:08 83.712 vsdata.dll
29.08.2005 18:52 54.960 vsutil_loc0407.dll
07.08.2005 10:24 2.266 qtplugin.log
07.08.2005 10:23 0 QuickTime.qtp
07.08.2005 10:00 176.167 rmoc3260.dll
07.08.2005 09:59 5.632 pndx5032.dll
07.08.2005 09:59 6.656 pndx5016.dll
07.08.2005 09:59 278.528 pncrt.dll
06.08.2005 10:42 32 {28D9DDAC-1F4D-41A9-99E4-597044FB3228}.dat
06.08.2005 10:42 14 SR2.dat
06.08.2005 10:22 251 spupdwxp.log
05.08.2005 15:51 913 $winnt$.inf
05.08.2005 15:47 200 UNDO_GUIMODE.TXT
05.08.2005 15:45 333 $ncsp$.inf
05.08.2005 15:28 66.048 VCLSMP50.bpl
05.08.2005 15:28 2.020.864 VCL50.bpl
05.08.2005 15:28 248.832 VCLX50.bpl
05.08.2005 15:15 25.065 wmpscheme.xml
05.08.2005 15:11 2.953 CONFIG.NT
05.08.2005 15:10 488 WindowsLogon.manifest
05.08.2005 15:10 488 logonui.exe.manifest
05.08.2005 15:10 749 sapi.cpl.manifest
05.08.2005 15:10 749 cdplayer.exe.manifest
05.08.2005 15:10 749 wuaucpl.cpl.manifest
05.08.2005 15:10 749 ncpa.cpl.manifest
05.08.2005 15:10 749 nwc.cpl.manifest
05.08.2005 15:09 21.740 emptyregdb.dat
05.08.2005 15:07 0 h323log.txt
03.08.2005 09:33 520.456 LegitCheckControl.DLL
29.07.2005 20:07 73.728 asuninst.exe
20.07.2005 03:04 3.012.096 mshtml.dll


Verzeichnis von C:\DOKUME~1\major\LOKALE~1\Temp

17.12.2005 23:08 797.676 IMT4C.xml
17.12.2005 23:08 426 IMT4B.xml
17.12.2005 23:08 2.036 IMT4A.xml
17.12.2005 23:07 797.676 IMT49.xml
17.12.2005 23:07 426 IMT48.xml
17.12.2005 23:07 2.036 IMT47.xml
17.12.2005 23:06 797.676 IMT38.xml
17.12.2005 23:06 426 IMT37.xml
17.12.2005 23:06 2.036 IMT36.xml
9 Datei(en) 2.400.414 Bytes
0 Verzeichnis(se), 34.045.960.192 Bytes frei

Verzeichnis von C:\WINDOWS

17.12.2005 23:53 0 0.log
17.12.2005 23:53 1.427.966 WindowsUpdate.log
17.12.2005 23:53 159 wiadebug.log
17.12.2005 23:53 50 wiaservc.log
17.12.2005 23:53 2.048 bootstat.dat
17.12.2005 23:51 32.526 SchedLgU.Txt
17.12.2005 23:19 81.514 ntbtlog.txt
17.12.2005 22:28 1.477 pstudio.ini
15.12.2005 16:31 32 pavsig.txt
15.12.2005 13:02 1.701.087 RESTORE.INS
15.12.2005 12:49 578 win.ini
15.12.2005 12:47 497.005 setupapi.log
15.12.2005 11:56 40 nero.INI
12.12.2005 22:03 40.660 iis6.log
12.12.2005 14:53 1.125 winamp.ini
07.12.2005 01:40 215.818 setupact.log
29.11.2005 20:49 28.479 wmsetup.log
26.11.2005 13:44 1.782 cdplayer.ini
24.11.2005 23:58 65.096 ntdtcsetup.log
24.11.2005 23:58 103.355 comsetup.log
24.11.2005 23:58 1.943 imsins.log
24.11.2005 23:58 17.489 ocmsn.log
24.11.2005 23:58 120.221 tsoc.log
24.11.2005 23:58 176.075 ocgen.log
24.11.2005 23:58 15.231 msgsocm.log
24.11.2005 23:58 273.286 FaxSetup.log
07.11.2005 04:43 52 amunres.lsl
03.11.2005 17:56 1.840 KB898458Uninst.log
14.09.2005 01:34 23.552 xobglu32.dll
14.09.2005 01:34 63.488 xobglu16.dll
18.08.2005 00:23 19.140 KB894391.log
18.08.2005 00:23 11.455 updspapi.log
18.08.2005 00:23 17.317 KB896423.log
18.08.2005 00:23 16.810 KB899587.log
18.08.2005 00:23 16.312 KB899591.log
18.08.2005 00:23 16.425 KB893756.log
18.08.2005 00:23 15.776 KB899588.log
18.08.2005 00:22 16.610 KB896727.log
15.08.2005 17:12 1.080 gramit32.cfg
08.08.2005 13:22 28 album.ini
08.08.2005 13:21 10 PSTUDIO.SN
07.08.2005 13:40 839.659 setuplog.txt
07.08.2005 10:51 775 hpinfo.lnk
07.08.2005 10:51 764 reg.prm
07.08.2005 10:49 376 mozregistry.dat
07.08.2005 09:57 316.640 WMSysPr9.prx
06.08.2005 20:46 57.048 KB896358.log
06.08.2005 20:46 58.913 KB890859.log
06.08.2005 20:45 54.766 KB901214.log
06.08.2005 20:45 29.557 KB903235.log
06.08.2005 20:45 54.974 KB893066.log
06.08.2005 20:45 29.673 KB898458.log
06.08.2005 20:45 56.139 KB883939.log
06.08.2005 20:44 50.473 KB896428.log
06.08.2005 20:44 50.807 KB896422.log
06.08.2005 20:44 50.935 KB890046.log
06.08.2005 20:44 50.243 KB885250.log
06.08.2005 20:44 50.310 KB885835.log
06.08.2005 20:44 50.293 KB893086.log
06.08.2005 20:44 49.154 KB887742.log
06.08.2005 20:44 49.050 KB873333.log
06.08.2005 20:43 46.739 KB888113.log
06.08.2005 20:43 46.716 KB891781.log
06.08.2005 20:43 46.882 KB887472.log
06.08.2005 20:43 46.192 KB888302.log
06.08.2005 20:43 45.805 KB885836.log
06.08.2005 20:43 24.640 KB886185.log
06.08.2005 20:43 45.802 KB873339.log
06.08.2005 20:43 2.066 vminst.log
06.08.2005 20:10 8.774 SYMEVENT.LOG
06.08.2005 13:15 7.191 KB898461.log
06.08.2005 13:15 5.089 KB893803v2.log
06.08.2005 10:58 23.876 LUINSTALL.LOG
06.08.2005 10:42 32 {E753C551-0A1F-4D41-96D3-1B0CFE7B0198}.dat
06.08.2005 10:41 83 MININU.LOG
06.08.2005 10:23 1.337 OEWABLog.txt
06.08.2005 10:23 28.863 spupdsvc.log
06.08.2005 10:23 731 DtcInstall.log
06.08.2005 10:20 400.905 svcpack.log
06.08.2005 10:17 200 cmsetacl.log
06.08.2005 10:16 2.409 sessmgr.setup.log
06.08.2005 10:08 613 medctroc.Log
05.08.2005 15:49 7.502 regopt.log
05.08.2005 15:47 158 setuperr.log
05.08.2005 15:47 231 system.ini
05.08.2005 15:45 61 smscfg.ini
05.08.2005 15:29 75 MAGIX.INI
05.08.2005 15:28 400 ODBC.INI
05.08.2005 15:28 4.335 ODBCINST.INI
05.08.2005 15:23 29 wgedit.ini
05.08.2005 15:22 15.169 WINNT32.LOG
05.08.2005 15:22 254 UPGRADE.TXT
05.08.2005 15:22 178 DHCPUPG.LOG
05.08.2005 15:18 849 orun32.ini
05.08.2005 15:18 189.025 orun32.isu
05.08.2005 15:16 423 Cmousecc.ini
05.08.2005 15:11 0 control.ini
05.08.2005 15:11 299.552 WMSysPrx.prx
05.08.2005 15:11 240 Windows Update.log
05.08.2005 15:10 749 WindowsShell.Manifest
05.08.2005 15:09 36 vb.ini
05.08.2005 15:09 37 vbaddin.ini
05.08.2005 15:06 0 Sti_Trace.log
27.05.2005 00:22 10.752 hh.exe


Verzeichnis von C:\

18.12.2005 00:04 0 sys.txt
18.12.2005 00:03 7.675 system.txt
18.12.2005 00:02 656 systemtemp.txt
17.12.2005 23:58 99.376 system32.txt
17.12.2005 23:53 402.653.184 pagefile.sys
07.08.2005 10:45 0 IO.SYS
07.08.2005 10:45 0 MSDOS.SYS
06.08.2005 10:17 211 BOOT.INI
06.08.2005 10:11 47.564 NTDETECT.COM
06.08.2005 10:11 251.184 ntldr
05.08.2005 15:11 219 BOOT.BAK


die mail habe ich raus geschickt. event. hat mein norton dazwischengefunkt. falls sie nicht angekommen ist, sage bescheid und ich schicke sie nochmal.

#12 Loesche folgendes:

17.12.2005 23:53 31.767 vsconfig.xml
16.12.2005 21:10 2.206 wpa.dbl
15.12.2005 16:31 2.550 Uninstall.ico
15.12.2005 16:31 1.406 Help.ico
15.12.2005 16:31 1.718 Open.ico
15.12.2005 16:31 1.406 AddQuit.ico
15.12.2005 16:31 5.350 IE.ico
15.12.2005 16:31 9.470 Desktop.ico
15.12.2005 16:31 1.718 Quick.ico
15.12.2005 12:50 0 asfiles.txt
12.12.2005 17:25 4.984 close.bmp
12.12.2005 17:25 19.712 insurance.bmp
12.12.2005 17:25 11.772 spyware.bmp
12.12.2005 17:25 21.224 xxx.bmp
12.12.2005 17:25 21.872 pharmacy.bmp
12.12.2005 17:25 21.872 dating.bmp
12.12.2005 17:25 23.480 gambling.bmp

Diese Datei bitte auch noch schicken und dann loeschen
12.12.2005 01:47 51.200 cssaz.exe

Nutze danach regelmaessig CCleaner von www.ccleaner.com
__________
MfG Ralf
SEO-Spam Hunter

#13 hi ralf!

muss nochmal danke für die hilfe sagen. prima service!
ein schönes weihnachtsfest dir und deiner familie!

#14 Ich hoffe das war es nun, mache noch zur Kontrolle einen Onlinescan mit Kaspersky und installiere dir mal die Demo von EWIDO von www.ewido.net um mehr Sicherheit zu haben.

Achja, loesche diese Datei bitte auch noch: zpmodemnt.sys

und euch ebenfalls eine frohe Weihnacht...
__________
MfG Ralf
SEO-Spam Hunter