lästige problemberichte... mit ernsthaften nervigen folgen

#1 habe probleme mit problembericht von explorer.exe, welcher erscheint wenn ich nur mit der maus auf einen bestimmten ordner zeige (limewire incomming) oder virensuchprogramme (norton antivir., adaware, stinger) diesen ordner untersuchen lasse. dann mussen die scanner oder auch der ordner beendet, geschlossen werden. es erscheint auch ein porblembericht von rundll 32.exe wenn, beispielsweise dtm race driver 2 gestartet wird...(rundll 32.exe ist aber nicht defekt!)
alle problemberichte haben ihren ursprung im temp ordner... vermute das ein (wurm?),aus von limewire downgeloadeten dateien, diese probleme verursacht.

hier noch mein logfile:


Logfile of HijackThis v1.99.1
Scan saved at 16:51:31, on 03.06.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE
C:\Programme\SlySoft\CloneCD\CloneCDTray.exe
C:\Programme\DAEMON Tools\daemon.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\NetPumper\NetPumperIEProxy.exe
C:\Programme\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Messenger\msmsgs.exe
C:\Dokumente und Einstellungen\...\Eigene Dateien\Eigene Bilder\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [EPSON Stylus C66 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE /P23 "EPSON Stylus C66 Series" /O6 "USB001" /M "Stylus C66"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [NetPumper] "C:\Programme\NetPumper\NetPumperIEProxy.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Programme\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Eraser] C:\Programme\Eraser\eraser.exe -hide
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136646697015
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.tynebridgewebcam.co.uk/camimages/AxisCamControl.ocx
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Programme\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programme\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe

bitte um hilfe... danke um vorraus...

#2 john...

öffne das HijackThis -- Button "scan" -- vor die Malware-Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten

Zitat

O4 - HKLM\..\Run: [NetPumper] "C:\Programme\NetPumper\NetPumperIEProxy.exe"
O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm

PC neustarten

**
deinstalliere:NetPumper

**
Counterspy
http://virus-protect.org/counterspy.html
* nach dem Scan muss man sich entscheiden für:

*Ignore
*Remove --> Status: Deleted
*Quarantaine

wähle immer Remove und starte den PC neu (dann kopiere den Scanreport ab
__________
MfG Sabina

rund um die PC-Sicherheit

#3 danke für die tipps!
Scanreport:

Spyware Scan Details
Start Date: 04.06.2006 10:49:47
End Date: 04.06.2006 11:54:59
Total Time: 1 hrs 5 mins 12 secs

Detected spyware

AntiLeech Plugin Adware (General) more information...
Details: Plugin is an Ad-Ware software which enables the broadcasting of advertisements, and execution of e-commerce and other internet related services on the user-interface of the software.
Status: Deleted

Infected files detected
c:\programme\anti-leech\alie_1.0.2.2\al2np.dll
c:\programme\anti-leech\alie_1.0.2.2\alhlp.exe
c:\programme\anti-leech\alie_1.0.2.2\alie.dll
c:\programme\anti-leech\alie_1.0.2.2\alie.inf
c:\programme\anti-leech\alie_1.0.2.2\iesetup2.exe
c:\programme\anti-leech\alnn\al2np.dll
c:\programme\anti-leech\alnn\alhlp.exe
c:\programme\anti-leech\alnn\npalnn.dll
c:\programme\anti-leech\alnn\setup2.exe

Infected registry entries detected
HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\AntiLeech.ALIE.1 Anti-Leech Plug-in
HKEY_CLASSES_ROOT\AntiLeech.ALIE
HKEY_CLASSES_ROOT\AntiLeech.ALIE\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\AntiLeech.ALIE\CurVer AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\AntiLeech.ALIE Anti-Leech Plug-in
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 C:\PROGRA~1\ANTI-L~1\ALIE_1~1.2\alie.dll
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 ThreadingModel Apartment
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\ProgID AntiLeech.ALIE.1
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\TypeLib {056738E1-E15C-11D6-B876-0050BF5D85C7}
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\VersionIndependentProgID AntiLeech.ALIE
HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7} Anti-Leech Plug-in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE DisplayName Anti-Leech Plugin for Internet Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE UninstallString C:\Programme\Anti-Leech\ALIE_1.0.2.2\iesetup2.exe uninstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN DisplayName Anti-Leech Plugin for Netscape, Mozilla, Opera
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN UninstallString C:\Programme\Anti-Leech\ALNN\setup2.exe -u


NetPumper Adware Bundler more information...
Details: Bundles with a number of adware components.
Status: Deleted

Infected files detected
c:\dokumente und einstellungen\patrick\anwendungsdaten\netpumper\patrick.ini
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031319.exe
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031328.exe
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031331.dll
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031332.dll
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031333.dll
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031334.exe
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031335.exe
C:\System Volume Information\_restore{E1246C19-18CA-4E31-A678-69104BCC8EBC}\RP171\A0031336.dll

Infected registry entries detected
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper
HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper VersionInfo efvLlBPXGf9tg3KkiqEHWjUutCo41ZQHXTBNSP+IRdu0ER23O7GTrvjN0QMqtDKWwxIM-sQxSaxYugY
KnS1mCr3Ln7f-
fhu4j0ony8eRCXoFwrS9d6PiGR4JqU8EoEdslj3Dw
cju40stxe+LtRMCtOpQpWKMJtVNYVo5wQ-UvWqxXhDKvCK+2Vfe5l08mn15E4nQaa-C4UQc
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\TypeLib {1145A909-A836-44B8-B03A-48D858B0F43E}
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\TypeLib Version 1.2
HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B} IAddUrl
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\TypeLib {1145A909-A836-44B8-B03A-48D858B0F43E}
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\TypeLib Version 1.2
HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000} IAddPackage
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\ProxyStubClsid {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\TypeLib {F7258F6E-9F60-49C0-8C82-F0A0993D68E0}
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\TypeLib Version 1.0
HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA} INetscapeInterface
HKEY_CLASSES_ROOT\TypeLib\{F7258F6E-9F60-49C0-8C82-F0A0993D68E0}
HKEY_CLASSES_ROOT\TypeLib\{F7258F6E-9F60-49C0-8C82-F0A0993D68E0}\1.0\0\win32 C:\Programme\NetPumper\NetPumperNNProxy.dll
HKEY_CLASSES_ROOT\TypeLib\{F7258F6E-9F60-49C0-8C82-F0A0993D68E0}\1.0\FLAGS 0
HKEY_CLASSES_ROOT\TypeLib\{F7258F6E-9F60-49C0-8C82-F0A0993D68E0}\1.0\HELPDIR C:\Programme\NetPumper\
HKEY_CLASSES_ROOT\TypeLib\{F7258F6E-9F60-49C0-8C82-F0A0993D68E0}\1.0 NetPumperNNProxy Library
HKEY_CURRENT_USER\Software\NetPumper
HKEY_CURRENT_USER\Software\NetPumper\Patrick Field1 2000728610
HKEY_CURRENT_USER\Software\NetPumper\Patrick Field2 857302731
HKEY_CURRENT_USER\Software\NetPumper\Patrick Field3 1017200966
HKEY_CURRENT_USER\Software\NetPumper\Patrick Field4 839008716


Trojan-Downloader.Small.popcorn Trojan Downloader more information...
Details: Trojan-Downloader.Small.popcorn is a trojan that downloads and installs malware from the internet. It can also change browser settings including the user's preferred home page.
Status: Deleted

Infected files detected
c:\windows\rdt.ini


Trojan.Startup.NameShifter.HY Trojan more information...
Details: Nameshifter refers to a family of trojans typically downloaded through security exploits. The Nameshifter group contains files that change names and have dynamic MD5 checksums.
Status: Deleted

Infected files detected
c:\ms32.sys


iDesk Adware (General) more information...
Details: iDesk is an application that sits on the desktop to guide users to the findwhales web site
Status: Deleted

Infected files detected
c:\windows\system32\drivers\zpmodemnt.sys

Infected registry entries detected
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZPMODEMSYSNTDRVNT\Enum INITSTARTFAILED 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZPMODEMSYSNTDRVNT\Enum NextInstance 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ZPMODEMSYSNTDRVNT\Enum Count 0


RBot.steam Trojan more information...
Status: Deleted

Infected files detected
C:\Program Files\Valve\platform\steam_dev.exe


ad.yieldmanager Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@ad.yieldmanager[2].txt


adriver Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@adriver[2].txt


Ads.cdfreaks Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@ads.cdfreaks[1].txt


PointRoll.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@ads.pointroll[1].txt


Advertising.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@advertising[1].txt


Adviva Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@adviva[1].txt


PriceBandit Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@apmebf[2].txt


ATDMT.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@atdmt[2].txt


Claria.DashBar Cookie Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@belnk[1].txt


BFast.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@bfast[2].txt


Bizrate Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@bizrate[1].txt


Bluestreak.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@bluestreak[1].txt


Bravenet.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@bravenet[1].txt


BS.Serving-Sys Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@bs.serving-sys[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@serving-sys[1].txt


BurstNet.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@burstnet[2].txt


casalemedia.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@casalemedia[2].txt


CGI-Bin Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@cgi-bin[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@cgi-bin[2].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@cgi-bin[3].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@cgi-bin[5].txt


ClickBank Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@clickbank[1].txt


Clickxchange.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@clickxchange[2].txt


Com.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@com[2].txt


dedmazai.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@counter12.sextracker[2].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@counter14.sextracker[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@counter2.sextracker[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@counter5.sextracker[1].txt


DoubleClick Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@doubleclick[2].txt


Ru4.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@edge.ru4[1].txt


Hitbox.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@ehg.hitbox[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@hitbox[1].txt


FastClick.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@fastclick[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@media.fastclick[1].txt


Findwhat Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@findwhat[1].txt


FortuneCity.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@fortunecity[2].txt


GeoCities Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@geocities[2].txt


Spyass.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@geo[1].txt


HC2.HumanClick Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@hc2.humanclick[2].txt


HotLog.ru Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@hotlog[2].txt


HyperTracker.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@hypertracker[1].txt


IndexTools.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@indextools[1].txt


Radar Spy 1.0 Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@landing.domainsponsor[1].txt
c:\dokumente und einstellungen\patrick\cookies\patrick@tradedoubler[2].txt


Desktop Spy Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@list[2].txt


maxserving Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@maxserving[2].txt


Mediaplex.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@mediaplex[2].txt


MetriWeb Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@metriweb[1].txt


Overture.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@overture[1].txt


PayCounter.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@paycounter[2].txt


QuestionMarket.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@questionmarket[1].txt


RealMedia.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@realmedia[2].txt


Revenue.net Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@revenue[2].txt


SexList.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@sexlist[1].txt


SexTracker.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@sextracker[1].txt


SpyLog.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@spylog[1].txt


Stat.Onestat Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@stat.onestat[2].txt


statcounter.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@statcounter[2].txt


TribalFusion.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@tribalfusion[1].txt


Tripod Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@tripod[1].txt


ValueClick.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@valueclick[1].txt


Weborama Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@weborama[1].txt


WindowsMedia Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@windowsmedia[2].txt


Ajan 1.0 Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@xiti[1].txt


XXXCounter.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@xxxcounter[1].txt


Adserver.com Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@z1.adserver[1].txt


Zedo Cookie (General) more information...
Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count
Status: Deleted

Infected cookies detected
c:\dokumente und einstellungen\patrick\cookies\patrick@zedo[2].txt

#4 da ist mehr drauf, als ich annahm....

1.
stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

2.
Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html
__________
MfG Sabina

rund um die PC-Sicherheit

#5 damit ich mir auch sicher bin...
wohin und worein muss ich die textdateien kopieren?

#6 wenn es hier waere... koennte ich nachsehen
__________
MfG Sabina

rund um die PC-Sicherheit

#7 schuldigung...
hab schon verstanden... hat sich erledigt...

#8 nun...wo sind die 4 Logs von datfindbat ???
__________
MfG Sabina

rund um die PC-Sicherheit

#9 hab noch so ne tolle frage also achtung
was ist in schritt 7 mit poste gemeint (wohin und wie??)
2.
finde datFind.bat nich...
bin gerade n bisschen überfodert und leicht deprimiert...

#10 datFind.zip --> entzippe datFind.zip --> datFind.bat
http://virus-protect.org/zip/datFind.zip


Kurzanleitung datfindbat

1. Doppel-klick DATFINDBAT

2. Es öffnet sich der Texteditor. Speichern als system32.txt - oder (rechter Mausklick --> Text markieren --> kopieren --> in den Thread einfügen) - (3 Monate vom Datum her, mehr ist nicht notwendig)

3. auf das Command Fenster klicken und beliebige Taste druecken

4. Es öffnet sich der Texteditor. Speichern als temp.txt - oder (rechter Mausklick --> Text markieren --> kopieren --> in den Thread einfügen) - (3 Monate vom Datum her, mehr ist nicht notwendig)

5. Wiederhole Schritt 3 und speichere als windows.txt - oder (rechter Mausklick --> Text markieren --> kopieren --> in den Thread einfügen) - (3 Monate vom Datum her, mehr ist nicht notwendig)

6. Wiederhole Schritt 3 und speichere als c.txt - oder (rechter Mausklick --> Text markieren --> kopieren --> in den Thread einfügen) - (3 Monate vom Datum her, mehr ist nicht notwendig)

7. Poste ALLE Logs (3 Monate vom Datum her, mehr ist nicht notwendig)
__________
MfG Sabina

rund um die PC-Sicherheit

#11 Datentr„ger in Laufwerk C: ist Klaus Berbel
Volumeseriennummer: B80F-F4DF

Verzeichnis von C:\WINDOWS\system32

28.05.2006 13:21 2.206 wpa.dbl
16.05.2006 14:34 87.808 S32EVNT1.DLL
09.05.2006 20:15 380.486 perfh009.dat
09.05.2006 20:15 52.900 perfc009.dat
09.05.2006 20:15 63.784 perfc007.dat
09.05.2006 20:15 391.330 perfh007.dat
09.05.2006 20:15 897.954 PerfStringBackup.INI
08.05.2006 19:35 90 spupdwxp.log
08.05.2006 19:34 130.096 FNTCACHE.DAT
04.05.2006 14:13 4.212 zllictbl.dat
04.05.2006 06:26 5.818.784 MRT.exe
28.04.2006 15:55 3.534 jupdate-1.5.0_03-b07.log
05.04.2006 13:43 43.520 CmdLineExt03.dll
31.03.2006 14:36 278.528 erasext.dll
31.03.2006 14:36 610.304 eraser.dll
30.03.2006 11:26 1.492.480 shdocvw.dll
30.03.2006 03:16 18.944 xpsp3res.dll
23.03.2006 22:34 3.074.560 mshtml.dll
18.03.2006 13:09 615.424 urlmon.dll
17.03.2006 11:11 679.424 inetcomm.dll
17.03.2006 06:03 8.493.056 shell32.dll
17.03.2006 02:38 28.672 verclsid.exe
10.03.2006 06:09 5.533.696 wmp.dll
04.03.2006 05:34 664.064 wininet.dll
04.03.2006 05:34 474.624 shlwapi.dll
04.03.2006 05:34 532.480 mstime.dll
04.03.2006 05:34 146.432 msrating.dll
04.03.2006 05:34 448.512 mshtmled.dll
04.03.2006 05:34 39.424 pngfilt.dll
04.03.2006 05:34 205.312 dxtrans.dll
04.03.2006 05:34 251.392 iepeers.dll
04.03.2006 05:34 1.056.256 danim.dll
04.03.2006 05:34 55.808 extmgr.dll
04.03.2006 05:34 96.768 inseng.dll
04.03.2006 05:34 152.064 cdfview.dll
04.03.2006 05:34 1.022.976 browseui.dll
01.03.2006 21:43 426.496 msdtcprx.dll
01.03.2006 21:43 11.776 xolehlp.dll
01.03.2006 21:43 956.416 msdtctm.dll
01.03.2006 21:43 91.136 mtxoci.dll
01.03.2006 21:43 66.560 mtxclu.dll
01.03.2006 21:43 161.280 msdtcuiu.dll

Datentr„ger in Laufwerk C: ist Klaus Berbel
Volumeseriennummer: B80F-F4DF

Verzeichnis von C:\DOKUME~1\Patrick\LOKALE~1\Temp

04.06.2006 12:03 49.152 ~DF8825.tmp
04.06.2006 12:03 4.876 jusched.log
04.06.2006 10:34 0 npv7.tmp
03.06.2006 20:40 2 PrePict.htm
03.06.2006 17:30 16.294 f5f1_appcompat.txt
03.06.2006 16:48 0 h2r1D.tmp
03.06.2006 16:39 0 h2r1A.tmp
03.06.2006 16:39 0 h2r17.tmp
03.06.2006 16:39 0 WKS15.tmp
02.06.2006 14:20 0 4B1B3B.dmp
01.06.2006 20:38 0 LEXA.tmp
01.06.2006 20:38 1.409 MSVD.tmp
01.06.2006 20:38 13.824 MSVC.tmp
01.06.2006 20:38 16.384 ~Qil2157.tmp
01.06.2006 20:35 758.784 WKSB.tmp
01.06.2006 19:39 0 5D821C.dmp
01.06.2006 19:39 2.448 770a_appcompat.txt
01.06.2006 16:51 956 scan0.sca
15.05.2006 14:53 96.035 Google_Earth_3.0.0762_060515-145307_1.dmp

Datentr„ger in Laufwerk C: ist Klaus Berbel
Volumeseriennummer: B80F-F4DF

Verzeichnis von C:\WINDOWS

04.06.2006 12:09 1.558.857 WindowsUpdate.log
04.06.2006 12:03 0 0.log
04.06.2006 12:03 2.048 bootstat.dat
04.06.2006 12:02 32.550 SchedLgU.Txt
03.06.2006 18:05 49 NeroDigital.ini
03.06.2006 17:46 50 wiaservc.log
03.06.2006 17:46 216 wiadebug.log
01.06.2006 15:08 1.409 QTFont.for
01.06.2006 15:08 54.156 QTFont.qfn
28.05.2006 17:02 63.380 wmsetup.log
22.05.2006 13:59 487 win.ini
22.05.2006 13:59 227 system.ini
12.05.2006 16:53 79.501 iis6.log
12.05.2006 16:53 122.247 comsetup.log
12.05.2006 16:53 13.847 ocmsn.log
12.05.2006 16:53 1.374 imsins.log
12.05.2006 16:53 202.699 tsoc.log
12.05.2006 16:53 73.540 ntdtcsetup.log
12.05.2006 16:53 11.940 KB913580.log
12.05.2006 16:53 269.988 ocgen.log
12.05.2006 16:53 26.216 msgsocm.log
12.05.2006 16:53 511.587 FaxSetup.log
12.05.2006 16:53 921.355 setupapi.log
12.05.2006 16:53 33.041 updspapi.log
09.05.2006 20:15 1.355 imsins.BAK
09.05.2006 20:15 15.399 KB885250.log
09.05.2006 20:15 16.564 KB900485.log
09.05.2006 20:15 15.433 KB887742.log
09.05.2006 20:15 15.170 KB887472.log
09.05.2006 20:14 17.800 KB912812.log
09.05.2006 20:14 5.981 KB886185.log
09.05.2006 20:14 11.139 KB911567.log
08.05.2006 21:10 24.789 KB904706.log
08.05.2006 19:56 0 MSDraw.ini
08.05.2006 19:37 30.011 spupdsvc.log
08.05.2006 19:37 360 DtcInstall.log
08.05.2006 19:36 316.640 WMSysPr9.prx
08.05.2006 19:35 1.174 OEWABLog.txt
08.05.2006 19:34 843.412 setuplog.txt
08.05.2006 19:22 437.892 svcpack.log
08.05.2006 19:22 212.178 KB913446.log
08.05.2006 19:21 219.136 KB912919.log
08.05.2006 19:20 242.669 KB911927.log
08.05.2006 19:20 239.212 KB911562.log
08.05.2006 19:19 229.796 KB910437.log
08.05.2006 19:18 249.675 KB908531.log
08.05.2006 19:17 217.582 KB908519.log
08.05.2006 19:16 216.883 KB905749.log
08.05.2006 19:16 224.055 KB905414.log
08.05.2006 19:15 242.656 KB902400.log
08.05.2006 19:14 222.322 KB901214.log
08.05.2006 19:13 235.223 KB901017.log
08.05.2006 19:12 224.731 KB900725.log
08.05.2006 19:12 236.039 KB899591.log
08.05.2006 19:11 244.734 KB899587.log
08.05.2006 19:10 213.909 KB896428.log
08.05.2006 19:09 238.150 KB896424.log
08.05.2006 19:09 235.464 KB896423.log
08.05.2006 19:08 243.163 KB896422.log
08.05.2006 19:07 233.360 KB896358.log
08.05.2006 19:06 235.697 KB893756.log
08.05.2006 19:05 222.552 KB891781.log
08.05.2006 19:05 220.116 KB890859.log
08.05.2006 19:04 224.339 KB890046.log
08.05.2006 19:03 218.901 KB888302.log
08.05.2006 19:02 229.691 KB888113.log
08.05.2006 19:01 236.900 KB885836.log
08.05.2006 19:01 241.989 KB885835.log
08.05.2006 19:00 229.582 KB873339.log
08.05.2006 18:56 200 cmsetacl.log
08.05.2006 18:56 1.330 sessmgr.setup.log
21.04.2006 13:44 5.999 xpsp1hfm.log
21.04.2006 13:44 33.236 KB835732.log
21.04.2006 13:39 27.385 KB912812-IE6SP1-20060322.182418.log
21.04.2006 13:38 26.451 KB914798.log
21.04.2006 13:37 29.623 KB905495.log
21.04.2006 13:37 24.141 KB911564.log
21.04.2006 13:31 8.588 KB911567-OE6SP1-20060316.165634.log
21.04.2006 13:30 6.459 KB911565.log
21.04.2006 13:27 12.010 KB835409.log
28.03.2006 15:19 384.003 DirectX.log
27.03.2006 17:10 509 eReg.dat
18.03.2006 14:03 798 GEARInstall.log

Datentr„ger in Laufwerk C: ist Klaus Berbel
Volumeseriennummer: B80F-F4DF

Verzeichnis von C:\

04.06.2006 12:45 0 sys.txt
04.06.2006 12:44 8.702 system.txt
04.06.2006 12:42 1.244 systemtemp.txt
04.06.2006 12:41 93.472 system32.txt
04.06.2006 12:03 805.306.368 pagefile.sys
22.05.2006 13:59 211 boot.ini
08.05.2006 18:48 47.564 NTDETECT.COM
08.05.2006 18:48 251.184 ntldr
04.05.2006 01:50 5.183 LGSInst.Log

(so gemeint? was muss ich jetzt machen?)

#12 Download f-secure-Beta Trial
http://www.f-secure.com/blacklight/
starte die Datei, nimm die Lizenzbestimmung an und waehle scan, wenn es mit dem Scan fertig ist, druecke next und danach close. Nun befindet sich im selben Ordner von Blacklight eine FSB*.TXT Datei
-> hier posten
__________
MfG Sabina

rund um die PC-Sicherheit

#13 06/04/06 13:35:43 [Info]: BlackLight Engine 1.0.37 initialized
06/04/06 13:35:43 [Info]: OS: 5.1 build 2600 (Service Pack 2)
06/04/06 13:35:43 [Note]: 7019 4
06/04/06 13:35:43 [Note]: 7005 0
06/04/06 13:35:47 [Note]: 7006 0
06/04/06 13:35:47 [Note]: 7011 1700
06/04/06 13:35:47 [Note]: 7026 0
06/04/06 13:35:47 [Note]: 7026 0
06/04/06 13:35:53 [Note]: FSRAW library version 1.7.1015
06/04/06 13:39:07 [Note]: 7007 0

hat also nichts gefunden... was gibts jetzt noch zu machen?

#14 nun, es ist alles wieder o.k.
scanne noch mal mit Counterspy, bis alles sauber bleibt.
__________
MfG Sabina

rund um die PC-Sicherheit

#15 echt klasse... danke für die hilfe!
gibt nur noch das problem mir der rundll 32.exe... kannst du mir da weiterhelfen?
(d.h. desktop - eigenschaften - desktop) lässt sich nicht anwählen. es erscheint ein problembericht