Problem mit SpyAxe + SpywareStrike - SpyFalcon - SpyGuard - AlfaCleaner - Sp

#1 Hi,
wie im Forenthread "SpyAxe + SpywareStrike - SpyFalcon - SpyGuard - AlfaCleaner - SpywareQuake " habe auch ich das Problem mit "fake" Programm!
Da ich allerdings wenig pc kenntnisse habe und ich nicht wirklich alles verstehe was in dem thread steht hoffe ich man kann mir das etwas deutlicher machen
Also ich habe "Cleanup" schon laufen lassen und danach "HiJackThis" angewendet, doch nun komme ich nicht weiter ;(
Ich hoffe man kann mir helfen
Mfg

#2 arbeite das ab und poste die Logs
http://board.protecus.de/t23188.htm
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Oh danke für die schnelle antwort:

Logfile of HijackThis v1.99.1
Scan saved at 16:08:16, on 18.05.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\AlienGUIse\wbload.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\Ideazon\Zboard Software\Driver\Zboard.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\Programme\Razer\Copperhead\razerhid.exe
C:\Programme\Logitech\Video\CameraAssistant.exe
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\ElkCtrl.exe
C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Programme\Razer\Copperhead\razertra.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Razer\Copperhead\razerofa.exe
C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\games\valve\steam\steam.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\your user name\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programme\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Nothing - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - C:\WINDOWS\system32\hp9DF7.tmp
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\de\msntb.dll (file missing)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Programme\Logitech\Video\InstallHelper.exe /inspect
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [razer] C:\Programme\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Programme\Logitech\Video\CameraAssistant.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation
O4 - HKLM\..\Run: [CTDVDDET] C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [RemoteCenter] C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [Steam] "c:\games\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O17 - HKLM\System\CCS\Services\Tcpip\..\{1F54F94C-0F46-4205-A0FD-40145A7A89FA}: NameServer = 217.237.151.33,194.25.2.125
O17 - HKLM\System\CS1\Services\Tcpip\..\{1F54F94C-0F46-4205-A0FD-40145A7A89FA}: NameServer = 217.237.151.33,194.25.2.125
O17 - HKLM\System\CS2\Services\Tcpip\..\{1F54F94C-0F46-4205-A0FD-40145A7A89FA}: NameServer = 217.237.151.33,194.25.2.125
O18 - Protocol: bw+0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {DA138053-8493-41B3-8D4D-2BFFA644C872} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WB - C:\Programme\AlienGUIse\fastload.dll
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programme\gemeinsame dateien\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

und hier das vom "datFind"

Verzeichnis von C:\WINDOWS\system32

18.05.2006 16:05 29.204 nvapps.xml
16.05.2006 18:06 5.032 stdole3.tlb
16.05.2006 16:17 5.632 simpole.tlb
16.05.2006 16:17 27.136 hp9DF7.tmp
16.05.2006 16:17 176.128 appmagr.dll
16.05.2006 16:17 44.544 dcomcfg.exe
16.05.2006 16:17 4.286 ot.ico
14.05.2006 17:55 13.646 wpa.dbl
04.05.2006 06:26 5.818.784 MRT.exe

Verzeichnis von C:\DOKUME~1\YOURUS~1\LOKALE~1\Temp

18.05.2006 16:33 978 TmpICQMagic_{05736BBE-C20F-4F10-A6DE-4DB1E3564B0E}16688.html
18.05.2006 16:15 206 jusched.log
18.05.2006 16:05 16.384 ~DF507C.tmp
18.05.2006 16:05 512 ~DFE15C.tmp
18.05.2006 16:05 16.384 ~DFE03E.tmp
18.05.2006 16:05 1.001 LVCOMSX.LOG
18.05.2006 16:03 44.542 e875_appcompat.txt


Verzeichnis von C:\WINDOWS

18.05.2006 16:05 0 0.log
18.05.2006 16:04 1.432.517 WindowsUpdate.log
18.05.2006 16:04 159 wiadebug.log
18.05.2006 16:04 50 wiaservc.log
18.05.2006 16:04 2.048 bootstat.dat
18.05.2006 16:03 32.630 SchedLgU.Txt
18.05.2006 15:01 60.416 ALCFDRTM.VER
16.05.2006 16:07 72.639 wmsetup.log
10.05.2006 15:00 45.896 iis6.log
10.05.2006 15:00 107.599 comsetup.log
10.05.2006 15:00 16.275 ocmsn.log
10.05.2006 15:00 63.486 ntdtcsetup.log
10.05.2006 15:00 114.481 tsoc.log
10.05.2006 15:00 1.374 imsins.log
10.05.2006 15:00 12.063 KB913580.log


Verzeichnis von C:\

18.05.2006 16:40 0 sys.txt
18.05.2006 16:39 9.029 system.txt
18.05.2006 16:37 696 systemtemp.txt
18.05.2006 16:34 99.291 system32.txt
18.05.2006 16:04 2.147.012.608 hiberfil.sys
18.05.2006 16:04 2.145.386.496 pagefile.sys

#4 hunterdeluxe

Laden und alles auf dem Desktop entpacken:

*) spyfalcon.zip -> http://virus-protect.org/zip/spyfalcon.zip -> entpacken auf dem Desktop -> spyfalcon.reg

*) SmitRem2.8 -->
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
Doppelklick: smitRem.exe -> Klicke: Start --> klicke: ok

-------------------------------------------
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren: ............

C:\WINDOWS\system32\nvapps.xml
C:\WINDOWS\system32\stdole3.tlb
C:\WINDOWS\system32\simpole.tlb
C:\WINDOWS\system32\appmagr.dll
C:\WINDOWS\system32\dcomcfg.exe
C:\WINDOWS\system32\ot.ico

**
Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken). http://www.bsi.bund.de/av/texte/wiederher.htm

**
Die Datei "spyfalcon.reg" auf dem Desktop doppelklicken --> und mit "ja"/"yes" der Registry beifügen

**
Start - Ausführen - cleanmgr (reinschreiben)
Klick: Temporäre Internet Files/Temporäre Internet Dateien -> o.k.
Klick: Temporäre Dateien -> o.k

**
öffne smitRem --> Doppelklick: RunThis.bat
warte, bis der Scan beendet ist (der Bildschirm wird blau werden. das ist normal)
------------------------------------------------------------

boote wieder in den Normalmodus

**
deaktiviere die Systemwiederherstellung (XP) (dann aktiviere sie wieder)
Arbeitsplatz-->rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren.

**
scanne mit superantispyware (free)
http://virus-protect.org/artikel/tools/superantispyware.html
+
berichte
__________
MfG Sabina

rund um die PC-Sicherheit

#5 Vielen dank ich werds direkt mal machen

edit: *) SmitRem2.8 --> http://noahdfear.geekstogo.com/click20counter/click.php?id=1
Doppelklick: smitRem.exe -> Klicke: Start --> klicke: ok
unbekannt url!
schon erledigt hab nen funktionierenden link in einem älteren thread gefunden!


edit 2: Hab alles ausgeführt er hat 14 threads gefunden und die unter Quarantäne gestellt! Problem scheint behoben worden zu sein
Vielen dank hast mir echt geholfen