Keine ahnung von HijackThis + datfindbat u.s.w

#16 1.
loesche: C:\!KillBox\

2.
Die XP-Firewall wieder aktivieren [Windows-Firewall/Gemeinsame Nutzung der Internetverbindung]
http://www.wintotal.de/Tipps/Eintrag.php?TID=1157

dann sollte wieder alles o.k. sein
__________
MfG Sabina

rund um die PC-Sicherheit

#17

Zitat

stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html

ich suche die Malware raus und erklaere alles weitere....

hi all! bzw. sabrina ich schließ mich da mal an, hab den gleichen sch**** troja etc... hoffe mal das mir auch so schnell geholfen wird. ich dachte mir ich poste mal meine Logs! wollte erst gleiche hilfe wie von pilepale nehmen aber ich dachte mir ich warte auf deine "einweisung"

also hier #1:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0C12-63EF

Verzeichnis von C:\WINDOWS\system32

29.05.2006 13:01 5.092 stdole3.tlb
29.05.2006 07:12 9.216 simpole.tlb
29.05.2006 07:12 60.928 hp100.tmp
29.05.2006 07:12 67.085 ld101.tmp
28.05.2006 19:59 384 DVCState-{00000001-00000000-00000009-00001102-00000004-20021102}.dat
28.05.2006 19:59 384 DVCStateBkp-{00000001-00000000-00000009-00001102-00000004-20021102}.dat
28.05.2006 19:59 1.080 settings.sfm
28.05.2006 19:59 1.080 settingsbkup.sfm
28.05.2006 19:59 32.088 BMXCtrlState-{00000001-00000000-00000009-00001102-00000004-20021102}.rfx
28.05.2006 19:59 32.088 BMXBkpCtrlState-{00000001-00000000-00000009-00001102-00000004-20021102}.rfx
28.05.2006 19:59 32.592 BMXStateBkp-{00000001-00000000-00000009-00001102-00000004-20021102}.rfx
28.05.2006 19:59 32.592 BMXState-{00000001-00000000-00000009-00001102-00000004-20021102}.rfx
25.05.2006 21:40 3.002 CONFIG.NT
24.05.2006 13:02 79.373 regperf.exe
24.05.2006 12:50 92.672 dcomcfg.exe
23.05.2006 16:24 2.206 wpa.dbl
23.05.2006 16:20 2 wapisu.exe
23.05.2006 16:20 156.672 oins.exe
23.05.2006 16:20 4.096 33a37f82.exe
23.05.2006 16:20 12.162 winmfu32.dll
23.05.2006 15:49 11.024 atmclk.exe
23.05.2006 15:49 4.286 ot.ico
23.05.2006 15:49 4.286 ts.ico
27.04.2006 19:50 597.504 aswBoot.exe
27.04.2006 19:42 90.112 AVASTSS.scr
26.03.2006 23:19 311.604 perfh009.dat
26.03.2006 23:19 39.992 perfc009.dat
26.03.2006 23:19 316.594 perfh007.dat
26.03.2006 23:19 48.156 perfc007.dat
26.03.2006 23:19 723.744 PerfStringBackup.INI
02.03.2006 01:44 2.789 qtplugin.log
14.12.2005 17:04 98.304 CmdLineExt.dll

dann hier #2:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0C12-63EF

Verzeichnis von C:\DOKUME~1\Midget\LOKALE~1\Temp

29.05.2006 12:28 475.202 02-1.wmv
29.05.2006 12:27 470.771 01-1.wmv
29.05.2006 12:27 479.633 05-3.wmv
29.05.2006 12:26 475.202 05-2.wmv
29.05.2006 12:26 475.202 06.wmv
29.05.2006 12:26 479.633 04-1.wmv
29.05.2006 12:25 470.771 03.wmv
29.05.2006 12:25 475.202 02.wmv
29.05.2006 12:25 475.202 01.wmv
29.05.2006 12:24 479.633 04.wmv
29.05.2006 12:23 475.202 05-1.wmv
29.05.2006 12:23 0 WMP603.tmp
29.05.2006 12:23 0 WMP602.tmp
29.05.2006 12:20 727.696 6.wmv
29.05.2006 12:19 737.134 5.wmv
29.05.2006 12:19 735.561 4.wmv
29.05.2006 12:18 774.886 3.wmv
29.05.2006 12:18 752.864 2.wmv
29.05.2006 12:17 778.032 1.wmv
29.05.2006 07:15 49.152 ~DFDA1.tmp
28.05.2006 02:38 0 WMP59D.tmp
28.05.2006 01:31 49.152 ~DF7E47.tmp
27.05.2006 20:03 49.152 ~DFB554.tmp
26.05.2006 18:22 34.617 ms2228.tmp
26.05.2006 18:22 34.617 ms2227.tmp
26.05.2006 18:07 41.262 ms754.tmp
26.05.2006 18:07 41.262 ms744.tmp
26.05.2006 13:36 4.576 java_install_reg.log
25.05.2006 21:38 49.152 ~DF386E.tmp
25.05.2006 10:47 49.152 ~DFA0DD.tmp
25.05.2006 10:44 49.152 ~DF4C38.tmp
25.05.2006 08:23 49.152 ~DF2061.tmp
25.05.2006 07:35 49.152 ~DF8DA6.tmp
24.05.2006 22:17 0 WMP51C.tmp
24.05.2006 20:44 49.152 ~DF242A.tmp
24.05.2006 13:07 283 wahtmltmp00.htm
24.05.2006 12:50 49.152 ~DFEBCB.tmp
23.05.2006 22:32 213 1F1205F7.TMP
23.05.2006 19:42 13.164 control.xml
23.05.2006 18:51 49.152 ~DF5067.tmp
23.05.2006 18:26 49.152 ~DFE6FD.tmp
23.05.2006 16:20 181 cli2A.bat
23.05.2006 16:20 0 win41.tmp
23.05.2006 16:20 0 win40.tmp
23.05.2006 16:20 0 win3C.tmp
23.05.2006 16:20 0 win38.tmp
23.05.2006 16:20 0 36.tmp
23.05.2006 16:20 0 win35.tmp
23.05.2006 16:20 78.336 win34.tmp.exe
23.05.2006 16:20 0 win33.tmp
23.05.2006 16:20 4.096 win2F.tmp.exe
23.05.2006 16:20 0 win31.tmp
23.05.2006 16:20 0 win2D.tmp
23.05.2006 16:20 931 win2B.tmp
23.05.2006 16:20 12.162 cli2A.tmp
23.05.2006 15:38 0 WMP10.tmp
18.05.2006 00:31 119 0CF6E057.TMP
07.05.2006 22:16 0 WER4.tmp
04.05.2006 01:33 62.332 AAX1FD.tmp
04.05.2006 01:33 62.332 AAX1FC.tmp
30.04.2006 22:14 0 WMP1FD.tmp
24.04.2006 17:22 16.384 ~DF5E86.tmp
24.04.2006 17:22 16.384 ~DF567B.tmp
24.04.2006 17:22 512 ~DF5687.tmp
22.04.2006 00:15 0 WER5DA.tmp
21.04.2006 13:33 623.410 pf2793456547.tmp
21.04.2006 13:29 611.451 pf2030938503.tmp
20.04.2006 23:54 0 WER17.tmp
20.04.2006 00:36 0 WMP92D.tmp
20.04.2006 00:36 0 WMP92C.tmp
20.04.2006 00:26 475.202 05.wmv
19.04.2006 00:29 0 aax2B.tmp
18.04.2006 17:01 49.152 ~DFA85F.tmp
31.03.2006 00:47 4.862.536 audio84712218.tmp
31.03.2006 00:47 5.455.474 audio84916140.tmp
21.11.2005 21:58 31.744 7e4a1.mst

next one

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0C12-63EF

Verzeichnis von C:\WINDOWS

29.05.2006 07:35 54.156 QTFont.qfn
29.05.2006 07:12 4.933.320 {00000001-00000000-00000009-00001102-00000004-20021102}.CDF
29.05.2006 07:12 0 0.log
29.05.2006 07:12 2.048 bootstat.dat
28.05.2006 19:58 32.558 SchedLgU.Txt
27.05.2006 20:13 269 LEXSTAT.INI
27.05.2006 10:54 0 .protected
26.05.2006 20:23 3.441 nero.INI
23.05.2006 19:43 273.164 wmsetup.log
23.05.2006 18:47 59.377 iis6.log
23.05.2006 18:47 10.347 ntdtcsetup.log
23.05.2006 18:47 19.908 comsetup.log
23.05.2006 18:47 15.838 tsoc.log
23.05.2006 18:47 1.937 tabletoc.log
23.05.2006 18:47 1.374 imsins.log
23.05.2006 18:47 10.531 KB893803v2.log
23.05.2006 18:47 1.464 msgsocm.log
23.05.2006 18:47 4.643 netfxocm.log
23.05.2006 18:47 1.489 ocmsn.log
23.05.2006 18:47 21.675 ocgen.log
23.05.2006 18:47 23.904 FaxSetup.log
23.05.2006 18:47 13.384 msmqinst.log
23.05.2006 18:47 766.764 setupapi.log
23.05.2006 17:16 130 ODBC.INI
08.05.2006 11:56 911 winamp.ini
08.05.2006 01:39 1.624.854 Mozilla Wallpaper.bmp
04.05.2006 00:17 2.072 ModemLog_SAMSUNG Mobile USB Modem 1.0.txt
03.05.2006 18:14 47 wiaservc.log
03.05.2006 17:53 159 wiadebug.log
22.04.2006 00:15 182.547 setupact.log
22.04.2006 00:09 1.374 imsins.BAK
22.04.2006 00:09 16.355 KB893803.log
20.04.2006 13:57 578 win.ini
20.04.2006 13:57 227 system.ini
21.02.2006 00:13 31 GunzLauncher.INI
20.01.2006 00:21 4.933.320 {00000001-00000000-00000009-00001102-00000004-20021102}.BAK

last one

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0C12-63EF

Verzeichnis von C:\

29.05.2006 13:15 0 sys.txt
29.05.2006 13:14 7.667 system.txt
29.05.2006 13:11 97.986 system32.txt
29.05.2006 13:10 4.032 systemtemp.txt
29.05.2006 07:12 805.306.368 pagefile.sys
27.05.2006 10:54 0 .protected
20.04.2006 13:57 194 boot.ini
11.03.2006 17:40 948.936 install_flash_player.exe

#18 Xclusive

Laden und alles auf dem Desktop entpacken:

1.
BFU (Brute Force Uninstaller) kann man hier herunterladen: --> http://www.merijn.org/files/bfu.zip

2.
spyfalcon.zip : http://virus-protect.org/artikel/bfu/spyfalcon.zip --> entzippe--> Datei spyfalcon.bfu

3. SmitRem2.8
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
Doppelklick: smitRem.exe -> Klicke: Start --> klicke: ok

4. spyfalcon.zip -> http://virus-protect.org/zip/spyfalcon.zip -> entpacken auf dem Desktop -> spyfalcon.reg

-------------------------------------------------------------------------
5.
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren: ...

Zitat

C:\WINDOWS\system32\stdole3.tlb
C:\WINDOWS\system32\simpole.tlb
C:\WINDOWS\system32\regperf.exe
C:\DOKUME~1\Midget\LOKALE~1\Temp\win34.tmp.exe
C:\DOKUME~1\Midget\LOKALE~1\Temp\win33.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win2F.tmp.exe
C:\DOKUME~1\Midget\LOKALE~1\Temp\cli2A.bat
C:\DOKUME~1\Midget\LOKALE~1\Temp\cli2A.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win41.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win40.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win3C.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win38.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\36.tmp
C:\DOKUME~1\Midget\LOKALE~1\Temp\win35.tmp
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\system32\wapisu.exe
C:\WINDOWS\system32\oins.exe
C:\WINDOWS\system32\33a37f82.exe
C:\WINDOWS\system32\winmfu32.dll
C:\WINDOWS\system32\atmclk.exe
C:\WINDOWS\system32\ot.ico
C:\WINDOWS\system32\ts.ico

6.
Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken). http://www.bsi.bund.de/av/texte/wiederher.htm

7.
Die Datei "spyfalcon.reg" auf dem Desktop doppelklicken --> und mit "ja"/"yes" der Registry beifügen

8.
suche: C:\!KillBox
und lösche alle dort eventuell befindlichen Dateien manuell

-------------------------------------------------------
9.
Öffne den Brute Force Uninstaller
* - klicke auf --> --> und suche die spyfalcon.bfu (unter Desktop) --> öffnen
* show log after script ends (anhaken)
* Execute klicken

-------------------------------------------------------
10.
* öffne smitRem --> Doppelklick: RunThis.bat warte, bis der Scan beendet ist (der Bildschirm wird blau werden. das ist normal)

wenn ein uninstaller vorhanden ist, den smitRem entfernt, wird der uninstaller gestartet. Klicke einfach den Uninstall button und warte, bis deinstalliert wurde.

------------------
11.
boote wieder in den Normalmodus

-----------------
12.
deaktiviere die Systemwiederherstellung (XP) (dann aktiviere sie wieder)
Arbeitsplatz-->rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.

13.
scanne - poste den scanreport, bitte
http://virus-protect.org/artikel/tools/superantispyware.html

14.
Hijackthis
http://computercops.biz/zx/Merijn/hijackthis.zip
http://virus-protect.org/hjtkurz.html
Lade/entpacke HijackThis in einem Ordner
--> None of the above just start the program --> Save--> Savelog -->es öffnet sich der Editor
nun das KOMPLETTE Log mit rechtem Mausklick abkopieren und ins Forum mit rechtem Mausklick "einfügen"

15.
noch mal die 4 Logs von datfindbat posten
__________
MfG Sabina

rund um die PC-Sicherheit

#19 so, sieht sehr gut aus! keine einzige meldung mehr. hier das Hijackthis Save Log

Logfile of HijackThis v1.99.1
Scan saved at 15:17:18, on 29.05.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\Creative\MediaSource\GO\CTCMSGo.exe
C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
E:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe
C:\PROGRA~2\3com\CONNEC~1\Common\MOTIVE~1.EXE
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\mozilla\mozilla.exe
C:\Dokumente und Einstellungen\Midget\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
R3 - URLSearchHook: (no name) - {CA2B30BE-852B-BBDF-0900-FD3AF42124C0} - C:\WINDOWS\System32\mqdcqqm.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Programme\Spybot - Search & Destroy\SDHelper.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKCU\..\Run: [Creative MediaSource Go] C:\Programme\Creative\MediaSource\GO\CTCMSGo.exe /SYS
O4 - HKCU\..\Run: [RemoteCenter] C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [ctmmep] C:\WINDOWS\System32\ctmmep.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: .protected
O4 - Global Startup: .protected
O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programme\AIM95\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5F13DF9-8ADF-4435-B818-F2239770B05A}: Domain = 0001
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5F13DF9-8ADF-4435-B818-F2239770B05A}: NameServer = 205.188.146.145
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = 0001
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = 0001
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = 0001
O20 - Winlogon Notify: SASWinLogon - C:\Programme\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: winmfu32 - winmfu32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - Unknown owner - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe

was kann da jetz gelöscht werden?

#20 Xclusive

öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

Zitat

R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - {CA2B30BE-852B-BBDF-0900-FD3AF42124C0} - C:\WINDOWS\System32\mqdcqqm.dll (file missing)
O4 - HKCU\..\Run: [ctmmep] C:\WINDOWS\System32\ctmmep.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O20 - Winlogon Notify: winmfu32 - winmfu32.dll (file missing)

PC neustarten

arbeite den escan ab und poste den report
http://www.hijackthis-forum.de/showpost.php?p=64957&postcount=3
__________
MfG Sabina

rund um die PC-Sicherheit

#21 daaaaaaaaaaaaaaaaaaaaaaaaanke sabina!!!^^ ist alles wieder ok gaaaaaaaaaaaaaaaaaaaaaaaaanz vielen herzlichen dank, bist echt ne richtig nette ciao pete

hab grad ein neues problem entdeckt!!
mein linker bilschirmrand flackert schwarz. aber nur wenn ich ein programm öffne, auf dem normalen desktop ist das bild klar.. weißt du da auch eine lösung?

#22 peter1234

poste bitte das log vom silentrunner
http://virus-protect.org/silentrunner.html
__________
MfG Sabina

rund um die PC-Sicherheit

#23 "Silent Runners.vbs", revision 45, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"AudioDeck" = "C:\Programme\VIAudioi\SBADeck\ADeck.exe 1" ["VIA Technologies, Inc."]
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"ToADiMon.exe" = "C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart" ["T-Online International AG, Marmiko IT-Solutions GmbH"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{49E0E0F0-5C30-11D4-945D-000000000003}\(Default) = (no title provided)
-> {HKLM...CLSID} = "IE PopUp-Killer ; Neikeisoft"
\InProcServer32\(Default) = "C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll" [null data]
{49E0E0F0-5C30-11D4-945D-000000000010}\(Default) = (no title provided)
-> {HKLM...CLSID} = "PopUpBlocker ; XpTuner2004"
\InProcServer32\(Default) = "C:\PROGRA~1\SIMONT~1\XP-TUN~1\PopUp.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Programme\TuneUp Utilities 2004\sdshelex.dll"" ["TuneUp Software GmbH"]
"{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson Datei-Manager"
-> {HKLM...CLSID} = "Sony Ericsson Datei-Manager"
\InProcServer32\(Default) = "C:\Programme\Sony Ericsson\Mobile\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"]
"{8e9d6600-f84a-11ce-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Objects"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{e3f2bac0-099f-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare UNC Folder Menu"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{52c68510-09a0-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Hood Verbs"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]


und nun?

#24 also von mir auch nochmal n dickes MERCY! bei mir passt wieder alles was mit dem virus zam hing ... puuuhh
und Superantispyware is n guter schutz für nebenbei! TOP!

jedoch, Sabina, i got a problem
...im HijackThis, nachdem ich gescannt hab - wo seh ich was Malware is und was nicht?

mercy chris!

#25 Xclusive

du musst korrekt arbeiten.
ich hatte dir oben den Link vom Escan gegeben und den Scanreport erbeten.
dann hatte ich dir auch geschrieben, was mit HijackThis zu fixen ist.
der Rechner ist noch nicht sauber, deshalb musst du alles korrekt abarbeiten
__________
MfG Sabina

rund um die PC-Sicherheit

#26 peter1234

ich kann nichts auffaelliges sehen (du hast allerdings nicht das komplette Log gepostet...es ist auf der Seite erklaert, wie man es erstellt) , ich vermute, dass es ein Hardware-Problem ist ..und kein Virenproblem.......
__________
MfG Sabina

rund um die PC-Sicherheit

#27 okk danke, aber der log müsste jetzt vollständig sein^^

"Silent Runners.vbs", revision 45, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS]
"AudioDeck" = "C:\Programme\VIAudioi\SBADeck\ADeck.exe 1" ["VIA Technologies, Inc."]
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"ToADiMon.exe" = "C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart" ["T-Online International AG, Marmiko IT-Solutions GmbH"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF Reader Link Helper"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{49E0E0F0-5C30-11D4-945D-000000000003}\(Default) = (no title provided)
-> {HKLM...CLSID} = "IE PopUp-Killer ; Neikeisoft"
\InProcServer32\(Default) = "C:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll" [null data]
{49E0E0F0-5C30-11D4-945D-000000000010}\(Default) = (no title provided)
-> {HKLM...CLSID} = "PopUpBlocker ; XpTuner2004"
\InProcServer32\(Default) = "C:\PROGRA~1\SIMONT~1\XP-TUN~1\PopUp.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{E0D79304-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79305-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79306-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{E0D79307-84BE-11CE-9641-444553540000}" = "WinZip"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\OFFICE11\msohev.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Programme\TuneUp Utilities 2004\sdshelex.dll"" ["TuneUp Software GmbH"]
"{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson Datei-Manager"
-> {HKLM...CLSID} = "Sony Ericsson Datei-Manager"
\InProcServer32\(Default) = "C:\Programme\Sony Ericsson\Mobile\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"]
"{8e9d6600-f84a-11ce-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Objects"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{e3f2bac0-099f-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare UNC Folder Menu"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{52c68510-09a0-11cf-8daa-00aa004a5691}" = "Shell extensions for NetWare"
-> {HKLM...CLSID} = "NetWare Hood Verbs"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
NetWareUNCMenu\(Default) = "{e3f2bac0-099f-11cf-8daa-00aa004a5691}"
-> {HKLM...CLSID} = "NetWare UNC Folder Menu"
\InProcServer32\(Default) = "nwprovau.dll" [MS]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {HKLM...CLSID} = "WinZip"
\InProcServer32\(Default) = "C:\PROGRA~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Manuel.MANUSPC\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\RAIN_1024.scr" ["ScreenTime Media"]


Enabled Scheduled Tasks:
------------------------

"1-Klick-Wartung" -> launches: "C:\Programme\TuneUp Utilities 2004\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000004\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 11, 14 - 29
%SystemRoot%\system32\rsvpsp.dll [MS], 12 - 13


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Recherchieren"

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]


Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\

Missing lines (compared with English-language version):
HIJACK WARNING! "TuneUp" = "file://C|/Dokumente und Einstellungen/All Users.WINDOWS/Anwendungsdaten/TuneUp Software/Common/base.css" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Guard, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["AVIRA GmbH"]
AntiVir PersonalEdition Classic Planer, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
Client Service für NetWare, NWCWorkstation, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\nwwks.dll" [MS]}
IPv6-Hilfsdienst, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}
Registry Management Service, RegManServ, "C:\Programme\Advanced Registry Doctor\RegManServ.exe" [null data]
Steganos Live Encryption Engine 11 [Service], SLEE_11_SERVICE, "C:\WINDOWS\system32\SLEE11.exe" [null data]
T-Online WLAN Adapter Steuerungsdienst, MZCCntrl, "C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe" ["T-Online International AG, Marmiko IT-Solutions GmbH"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 19 seconds, including 9 seconds for message boxes)


was zu seheN hab schon alles an meiner hardware ausprobiert...

#28 ich finde nichts... das Log ist o.k.
und hardware/Software-Probleme sind nicht mein Fach.
da musst du dich in einen anderen Forenteil bei protecus wenden.
http://board.protecus.de/f5.htm
__________
MfG Sabina

rund um die PC-Sicherheit

#29 mmmhhhh.... ich habs genau so gemacht wies beschrieben wurde! ich gehs nochmal durch. grad aus der arbeit gekommen, jetz erstmal kein bock rumzusuchen! verständlich oder bye

#30 bin auch gerade von der Arbeit gekommen

Zitat

Sabina postete
Xclusive

öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

Zitat

R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: (no name) - {CA2B30BE-852B-BBDF-0900-FD3AF42124C0} - C:\WINDOWS\System32\mqdcqqm.dll (file missing)
O4 - HKCU\..\Run: [ctmmep] C:\WINDOWS\System32\ctmmep.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Party-Poker\PartyPokerNet\RunPF.exe (file missing
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O20 - Winlogon Notify: winmfu32 - winmfu32.dll (file missing)

PC neustarten

arbeite den escan ab und poste den report
http://www.hijackthis-forum.de/showpost.php?p=64957&postcount=3

wenn es heute zu spaet wird...mach es morgen
__________
MfG Sabina

rund um die PC-Sicherheit