task manager durch administrator deaktiviert

#1 hallo,
ich habe mir anscheinend einen virus eingefangen.
NAV, adaware, und spybot sind aktualisiert. spybot hatte auch eine änderung
in der registrierung gemeldet. eintrag für task manager habe ich gelöscht.
in schöner regelmässigket meldet sich spybot: "änderung in der registrierungsdatenbank verboten" - hatte ich so eingestellt. dies zeigt aber doch das der virus noch aktiv ist und arbeitet.

hier mal mein log file, vielleicht kann mir jemand helfen:

Logfile of HijackThis v1.99.1
Scan saved at 09:47:21, on 29.12.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\Dit.exe
C:\Programme\NavNT\vptray.exe
C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
C:\Programme\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Microsoft Office\Office\1031\msoffice.exe
C:\Programme\NavNT\defwatch.exe
C:\Programme\NavNT\rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SCARDS32.EXE
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\loadclean.exe
C:\WINDOWS\loadclean.exe
C:\WINDOWS\loadclean.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\RUNDLL32.exe
D:\Diverse Downloads\Datenrettung_Sicherheit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.ebay.de/_W0QQfgtpZ1QQfrppZ25QQsassZmikeQ5feQQssPageNameZrviQ3a3Q3a1
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [vptray] C:\Programme\NavNT\vptray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v1] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis1.exe
O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\System32\PCLECoInst.dll",CheckUSBController
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O16 - DPF: {271A3CF5-5A54-447B-A08F-BE805F0DA60B} (DataDesign DDBAC Plug-In) - https://banking.seb.de/hbci/plugin/AXFOAM.CAB
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Programme\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Programme\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Programme\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Programme\AutoCAD 2002\AcPreview.ocx
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Programme\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Programme\NavNT\rtvscan.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - Towitoko AG - C:\WINDOWS\SCARDS32.EXE

danke und gruss
mike

#2 Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten --> kopiere das Ergebnis in das Sicherheitsforum
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\loadclean.exe
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hallo Sabina,
loadclean.exe hatte ich zwischenzeitlich auch lokalisiert. nachdem er sich nicht löschen ließ, habe ich ihm eine txt endung verpasst, seitdem ist ruhe.
NAV hat heute, nach aktualisierung noch einen Trojaner Dc3.txt gefunden. den kann ich aber nicht checken lassen, da er in einem verzeichnis angegeben ist, das ich im explorer gar nicht finden kann: C:\RECYCLER\S-1-5-21-1390067357-16148....\
hier noch das ergebnis:
vielen dank für die hilfe
mike


Antivirus Version Update Result
AntiVir 6.33.0.70 12.29.2005 TR/Dldr.Harnig.AZ
Avast 4.6.695.0 12.29.2005 Win32:Zlob-AO
AVG 718 12.29.2005 no virus found
Avira 6.33.0.70 12.29.2005 TR/Dldr.Harnig.AZ
BitDefender 7.2 12.30.2005 BehavesLike:Trojan.Downloader
CAT-QuickHeal 8.00 12.29.2005 (Suspicious) - DNAScan
ClamAV devel-20051123 12.29.2005 Trojan.Gobot-7
DrWeb 4.33 12.30.2005 Trojan.DownLoader.6156
eTrust-Iris 7.1.194.0 12.30.2005 Win32/Norsd.B!Trojan
eTrust-Vet 12.4.1.0 12.30.2005 Win32/Norsd!generic
Ewido 3.5 12.30.2005 Downloader.Delf.wu
Fortinet 2.54.0.0 12.30.2005 W32/Bizves.WU!dldr
F-Prot 3.16c 12.30.2005 no virus found
Ikarus 0.2.59.0 12.29.2005 no virus found
Kaspersky 4.0.2.24 12.30.2005 Trojan-Downloader.Win32.Delf.wu
McAfee 4661 12.28.2005 no virus found
NOD32v2 1.1344 12.29.2005 a variant of Win32/TrojanDownloader.Delf.OG
Norman 5.70.10 12.30.2005 W32/Downloader
Panda 9.0.0.4 12.29.2005 Adware/WinHound
Sophos 4.01.0 12.30.2005 Troj/Bizves-Gen
Symantec 8.0 12.30.2005 Downloader.Trojan
TheHacker 5.9.1.064 12.29.2005 no virus found
UNA 1.83 12.29.2005 no virus found
VBA32 3.10.5 12.28.2005 no virus found

#4 mike_e

SmitRem2.8
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

laden--> in den abgesicherten Modus booten --> öffne smitRem folder --> Doppelklick: RunThis.bat warte, bis der Scan beendet ist (der Bildschirm wird blau werden. das ist normal) suche smitfiles.txt --> poste sie hier


Download f-secure-Beta Trial
http://www.f-secure.com/blacklight/
doppelklick: blbeta.exe
nach dem Check klicke -- next
nun findet man eine log-datei auf dem Desktop: kopiere sie in deinen Thread

Winhound
http://virus-protect.org/artikel/spyware/winhound.html
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Hallo Sabina,
hier der smitfiles.txt:

smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key
ShudderLTD key not present!
checking for PSGuard.com key
PSGuard.com key not present!
checking for WinHound.com key
WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Existing Pre-run Files

~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 884 'explorer.exe'
Killing PID 884 'explorer.exe'

Starting registry repairs
Deleting files
Remaining Post-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~
wininet.dll is missing!!

und hier die log datei:

12/30/05 17:29:38 [Info]: BlackLight Engine 1.0.30 initialized
12/30/05 17:29:38 [Info]: OS: 5.1 build 2600 (Service Pack 1)
12/30/05 17:29:38 [Note]: 7019 4
12/30/05 17:29:38 [Note]: 7005 0
12/30/05 17:29:47 [Note]: 7006 0
12/30/05 17:29:47 [Note]: 7011 788
12/30/05 17:29:47 [Note]: FSRAW library version 1.7.1014
12/30/05 17:30:49 [Note]: 7007 0

Danke, Gruss und guten Rutsch
mike

#6 die wininet.dll ist nicht da:

also mache folgendes:

Start -- alle Programme -- Zubehör -- Editor und kopiere folgenden Text rein:

dir %Systemdrive%\wininet.dll /a h /s > files.txt
start notepad files.txt

- Speichern als: wininet.bat
- abspeichern unter : Dateityp: alle Dateien
- speichere auf dem Desktop
- Locate wininet.bat -- doppelklick auf die bat-Datei , der Editor öffnet sich -- poste den Text
__________
MfG Sabina

rund um die PC-Sicherheit

#7 here it is:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: B43B-33E6

Verzeichnis von C:\WINDOWS\$NtUninstallKB883939-IE6SP1-20050428.125228$

29.08.2002 13:00 604.672 wininet.dll
1 Datei(en) 604.672 Bytes

Verzeichnis von C:\WINDOWS\SoftwareDistribution\Download\641ce3171b8ee1a41b9b6c48ce3370d6\rtmgdr

27.04.2005 15:41 581.632 wininet.dll
1 Datei(en) 581.632 Bytes

Verzeichnis von C:\WINDOWS\SoftwareDistribution\Download\641ce3171b8ee1a41b9b6c48ce3370d6\RTMQFE

27.04.2005 23:35 591.872 wininet.dll
1 Datei(en) 591.872 Bytes

Verzeichnis von C:\WINDOWS\system32

27.04.2005 15:41 581.632 WININET.DLL
1 Datei(en) 581.632 Bytes

Verzeichnis von C:\WINDOWS\system32\dllcache

27.04.2005 15:41 581.632 WININET.DLL
1 Datei(en) 581.632 Bytes

Gruss
mike

#8 nun scanne noch mal mit SmitRem2.8 (unbedingt im abgesicherten Modus) und poste den scanbericht, ich hoffe, das Tool kopiert eine saubere dll um.
__________
MfG Sabina

rund um die PC-Sicherheit

#9 ...und hier nochmals smitfiles.txt:
Gruss
mike

smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key
ShudderLTD key not present!
checking for PSGuard.com key
PSGuard.com key not present!
checking for WinHound.com key
WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 856 'explorer.exe'
Killing PID 856 'explorer.exe'

Starting registry repairs

Deleting files


Remaining Post-run Files


~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~

wininet.dll is missing!!

#10 mike_e

der PC macht keine probleme ??? Ist alles wie es soll (wenn ja...ist mir ein Raetsel)

scanne mit kaspersky und poste den scanbericht
http://virus-protect.org/onlinescan.html
__________
MfG Sabina

rund um die PC-Sicherheit

#11 hier das Ergebnis:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Saturday, December 31, 2005 17:32:53
Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 31/12/2005
Kaspersky Anti-Virus database records: 158200
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan Statistics:
Total number of scanned objects: 69709
Number of viruses found: 2
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 3728 sec

Infected Object Name - Virus Name
C:\Dokumente und Einstellungen\Michael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Outlook\outlook.pst/Persönliche Ordner/Gelöschte Objekte/30 Dec 2005 03:26 from eBay:EBAY INC: URGENT SECURITY NOTICE FOR.html Infected: Trojan-Spy.HTML.Bayfraud.hl
C:\Dokumente und Einstellungen\Michael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Outlook\outlook.pst Infected: Trojan-Spy.HTML.Bayfraud.hl
D:\System Volume Information\_restore{1400ADB2-17D8-4BE2-BDEA-81E5E9ECBF3E}\RP108\A0008584.exe Infected: Trojan-Downloader.Win32.Harnig.ax

Scan process completed.

Gruss und guten Rutsch
mike

#12 im neuen jahr dann:
http://virus-protect.org/multiavtool.html
klicke "3" McAfee -- es erscheint ein leeres DOS-Fenster.
- man muss eingeben, was gescannt werden soll

- C:\Windows\System32 dann beginnt der Scan, man sollte dann auch scannen lassen:
- C:\Windows
- C:\

klicke "1" nun beginnt der Scan von Sophos
klicke "2" , nun beginnt der Scan von Trend Micro

poste dann alle 5 Scanreporte
__________
MfG Sabina

rund um die PC-Sicherheit

#13 Von Sophos konnte ich kein Logfile finden.
Hier von McAfee und Trend:

01/01/2006 13:07:50
Options:
"C:\WINDOWS\SYSTEM32" /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL /PROGRAM /EXCLUDE C:\AV-CLS\EXCLIST.TXT /HTML "C:\AV-CLS\MCAFEE\SCANREPORT.HTML"
Scanning C: []
Scanning C:\WINDOWS\SYSTEM32\*.*
Summary report on C:\WINDOWS\SYSTEM32\*.*
File(s)
Total files: ........... 7849
Clean: ................. 7839
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 1
Time: 00:07.25

01/01/2006 13:18:30


Options:
"C:\WINDOWS" /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL /PROGRAM /EXCLUDE C:\AV-CLS\EXCLIST.TXT /HTML "C:\AV-CLS\MCAFEE\SCANREPORT.HTML"

Scanning C: []
Scanning C:\WINDOWS\*.*
Summary report on C:\WINDOWS\*.*
File(s)
Total files: ........... 23762
Clean: ................. 23749
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 1
Time: 00:10.59


01/01/2006 13:38:30
Options:
"C:\" /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL /PROGRAM /EXCLUDE C:\AV-CLS\EXCLIST.TXT /HTML "C:\AV-CLS\MCAFEE\SCANREPORT.HTML"
Scanning C: []
Scanning C:\*.*
Summary report on C:\*.*
File(s)
Total files: ........... 111730
Clean: ................. 111688
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 2
Time: 00:34.21



/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/


2006-01-01, 14:25:09, Auto-clean mode specified.
2006-01-01, 14:25:09, Running scanner "c:\AV-CLS\Trend\TSC.BIN"...
2006-01-01, 14:25:37, Scanner "c:\AV-CLS\Trend\TSC.BIN" has finished running.
2006-01-01, 14:25:37, TSC Log:

Damage Cleanup Engine (DCE) 3.98(Build 1012)
Windows XP(Build 2600: Service Pack 1)

Start time : So Jan 01 2006 14:25:10

Load Damage Cleanup Template (DCT) "c:\AV-CLS\Trend\tsc.ptn" (version 692) [success]

Complete time : So Jan 01 2006 14:25:37
Execute pattern count(4621), Virus found count(0), Virus clean count(0), Clean failed count(0)

2006-01-01, 14:26:50, An error occurred while scanning file "C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT": Zugriff verweigert
2006-01-01, 14:26:50, An error occurred while scanning file "C:\Dokumente und Einstellungen\LocalService\ntuser.dat.LOG": Zugriff verweigert
2006-01-01, 14:26:50, An error occurred while scanning file "C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat": Zugriff verweigert
2006-01-01, 14:26:50, An error occurred while scanning file "C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG": Zugriff verweigert
2006-01-01, 14:26:51, An error occurred while scanning file "C:\Dokumente und Einstellungen\Michael\ntuser.dat": Zugriff verweigert
2006-01-01, 14:26:51, An error occurred while scanning file "C:\Dokumente und Einstellungen\Michael\ntuser.dat.LOG": Zugriff verweigert
2006-01-01, 14:27:27, An error occurred while scanning file "C:\Dokumente und Einstellungen\Michael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat": Zugriff verweigert
2006-01-01, 14:27:27, An error occurred while scanning file "C:\Dokumente und Einstellungen\Michael\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG": Zugriff verweigert
2006-01-01, 14:27:27, An error occurred while scanning file "C:\Dokumente und Einstellungen\Michael\Lokale Einstellungen\Temp\Perflib_Perfdata_594.dat": Zugriff verweigert
2006-01-01, 14:27:29, An error occurred while scanning file "C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT": Zugriff verweigert
2006-01-01, 14:27:29, An error occurred while scanning file "C:\Dokumente und Einstellungen\NetworkService\ntuser.dat.LOG": Zugriff verweigert
2006-01-01, 14:27:29, An error occurred while scanning file "C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat": Zugriff verweigert
2006-01-01, 14:27:29, An error occurred while scanning file "C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG": Zugriff verweigert
2006-01-01, 14:39:49, An error was detected on "C:\System Volume Information\*.*": Zugriff verweigert
2006-01-01, 14:39:56, An error occurred while scanning file "C:\WINDOWS\SCARDSRV.TMP": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\AD-AWARE.EXE-0B387BE8.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\BLBETA.EXE-2B21AAB4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\CMD.EXE-087B4001.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\CNMSM64.EXE-2E99C9C4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\CTXSETUP.EXE-2CFF4AF4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\DEFRAG.EXE-273F131E.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\DFRGNTFS.EXE-269967DF.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\DUMPREP.EXE-1B46F901.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\DWWIN.EXE-30875ADC.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\EXCEL.EXE-0D2E9C6C.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\FIND.EXE-0EC32F1E.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\HELPSVC.EXE-2878DDA2.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\ICA32T[1].EXE-05F2178A.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\IEXPLORE.EXE-2CA9778D.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\IKERNEL.EXE-092EF074.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\IMAPI.EXE-0BF740A4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\IPCONFIG.EXE-2395F30B.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\KIX32.EXE-0D30371A.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\KNLWRAP.EXE-35ACA01E.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\Layout.ini": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\LOGONUI.EXE-0AF22957.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\LUALL.EXE-2BCC229F.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\LUCOMS~1.EXE-02DB5950.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\MIGRATEN.EXE-01BEFC1A.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\MSGSYS.EXE-16CA9FEA.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\MSIEXEC.EXE-2F8A8CAE.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\MULTI_AV.EXE-06C9BCB4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\MWAVL.EXE-37004DC2.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\NOTEPAD.EXE-336351A9.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\NTOSBOOT-B00DFAAD.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\NTVDM.EXE-1A10A423.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\OUTLOOK.EXE-179DEC04.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\PCRESCUE.EXE-1B9610E8.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\PCRESCUESETUP.EXE-326B9843.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\PHOTOLINE.EXE-180CD8A4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\REGCLEANR.EXE-10DDC304.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\REGEDIT.EXE-1B606482.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\REGSVR32.EXE-25EEFE2F.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-2505184D.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-2E0FDD21.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\RUNDLL32.EXE-451FC2C0.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SC.EXE-012262AF.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SCARDS32.EXE-02F3A6A4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SCHEDHLP.EXE-1C337C21.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SDAT4664.EXE-1726EB6A.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SMITREM.EXE-351C5B24.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SPYBOTSD.EXE-1D495A65.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSCLEAN.COM-1EF28012.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\SYSCLEAN.EXE-31AEB4DC.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\T.EXE-2C5E72A5.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\T.EXE-332C4A5F.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\TASKMGR.EXE-20256C55.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\TL.EXE-1F86E8DE.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\TRUEIMAGE.EXE-1ED664E2.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\TSC.BIN-25A3BE24.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\TSC.EXE-3562C0B0.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\UNWISE.EXE-2711F311.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\VPC32.EXE-248E4702.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WFCRUN32.EXE-09B4197E.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WFICA32.EXE-3ABC11E7.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WGET.EXE-106A43C1.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WINWORD.EXE-0AEA99D4.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf": Zugriff verweigert
2006-01-01, 14:41:52, Could not set file for reading on "C:\WINDOWS\Prefetch\WUAUCLT.EXE-399A8E72.pf": Zugriff verweigert
2006-01-01, 14:42:22, An error occurred while scanning file "C:\WINDOWS\SoftwareDistribution\EventCache\{B4C8F9DC-C652-4059-93D3-0FC3073D2722}.bin": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\default": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\default.LOG": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\SAM.LOG": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\SECURITY.LOG": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\software": Zugriff verweigert
2006-01-01, 14:43:57, An error occurred while scanning file "C:\WINDOWS\system32\config\software.LOG": Zugriff verweigert
2006-01-01, 14:43:58, An error occurred while scanning file "C:\WINDOWS\system32\config\system": Zugriff verweigert
2006-01-01, 14:43:58, An error occurred while scanning file "C:\WINDOWS\system32\config\system.LOG": Zugriff verweigert
2006-01-01, 14:46:29, Running scanner "c:\AV-CLS\Trend\VSCANTM.BIN"...
2006-01-01, 15:05:51, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/1/2006 14:46:29
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 137 (117449 Patterns) (2005/12/29) (313700)
Command Line: c:\AV-CLS\Trend\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=c:\AV-CLS\Trend

52808 files have been read.
52808 files have been checked.
29251 files have been scanned.
38549 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/1/2006 15:05:51
---------*---------*---------*---------*---------*---------*---------*---------*
2006-01-01, 15:05:51, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/1/2006 14:46:29
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 137 (117449 Patterns) (2005/12/29) (313700)
Command Line: c:\AV-CLS\Trend\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=c:\AV-CLS\Trend

52808 files have been read.
52808 files have been checked.
29251 files have been scanned.
38549 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/1/2006 15:05:51 19 minutes 21 seconds (1161.03 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2006-01-01, 15:05:51, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 1/1/2006 14:46:29
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 137 (117449 Patterns) (2005/12/29) (313700)
Command Line: c:\AV-CLS\Trend\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=c:\AV-CLS\Trend

52808 files have been read.
52808 files have been checked.
29251 files have been scanned.
38549 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/1/2006 15:05:51 19 minutes 21 seconds (1161.03 seconds) has elapsed.

---------*---------*---------*---------*---------*---------*---------*---------*
2006-01-01, 15:05:51, Scanner "c:\AV-CLS\Trend\VSCANTM.BIN" has finished running.
2006-01-01, 15:10:59, An error was detected on "D:\System Volume Information\*.*": Zugriff verweigert

#14 gehe in die Registry

Start-->Ausfuehren--> regedit

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\System
DisableTaskMgr = "dword:00000001" <--in 0 aendern

dann muesste trotz der fehlenden wininet.dll wieder alles in Ordnung sein. (das mit der wininet.dll kann ich mir nicht erklaeren... aber was solls... wenn der PC keine Probleme macht )
__________
MfG Sabina

rund um die PC-Sicherheit

#15 Hi Sabina,

erst einmal ein frohes Neues Jahr!
Wollte nur kurz bemerken, dass ich smitRem zu Testzwecken auch auf meinem Laptop habe laufen lassen und dabei ebenfalls die Meldung über eine fehlende wininet.dll angezeigt wurde, obwohl die Datei definitiv im System-Verzeichnis vorhanden war.
Könnte sich deshalb vielleicht um einen Bug(?) handeln.

Gruß
Heron
__________
"Die Welt ist groß, weil der Kopf so klein"
Wilhelm Busch