Spyware Diskussion von unseren Experten... :)

#1 - Spyware Diskussion von Sabina, Arnold und Yourhighness -

#2 Hi!

Gute Sache. Mal sehen wies laeuft

Gruss Johannes

PS: Die Datei heisst Malware - ist aber natuerlich keine drin

Ist nur ein Teil meiner Sammlung von infizierten System32 Dateien
Hat uebrigens geflutscht wie sonst was. echt jute Sache ^^

LG,


__________
Yourhighness
Yourhighness' Seite / Mein Blog (Englisch)

#3 Tag,Yourhighness
Vielleicht etwas für Dich in 2006
Wenn diese Seite auch so gefärlich ist wie die andere(.com),weiss ich jetzt noch nicht


__________
MfG Argus

#4 Hi,

Danke dir, kenn ich noch nicht. Hab schon biene gesagt, das ich mir einige Vorsaetze fuers naechste Jahr gemacht hab ^^.

Zeitlich ist es aber trotzdem immer so ne Sache... 1000 Dank schon mal und nen guten Rutsch.

Lg,

JOhannes
__________
Yourhighness
Yourhighness' Seite / Mein Blog (Englisch)

#5 DatFind.Bat download


__________
MfG Argus

#6 Rootkit Infektion!

F-Secure Blacklight
04/05/06 21:42:03 [Info]: BlackLight Engine 1.0.35 initialized
04/05/06 21:42:03 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/05/06 21:42:03 [Note]: 7019 4
04/05/06 21:42:03 [Note]: 7005 0
04/05/06 21:42:08 [Note]: 7006 0
04/05/06 21:42:08 [Note]: 7011 1364
04/05/06 21:42:08 [Note]: 7026 0
04/05/06 21:42:09 [Note]: 7026 0
04/05/06 21:42:09 [Note]: FSRAW library version 1.7.1015
04/05/06 21:42:32 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
04/05/06 21:42:32 [Note]: 10002 1
04/05/06 21:42:44 [Info]: Hidden file: C:\WINDOWS\system32\dmakp.exe
04/05/06 21:42:44 [Note]: 7002 32
04/05/06 21:42:44 [Note]: 7003 1
04/05/06 21:42:44 [Note]: 10002 1
04/05/06 21:42:48 [Info]: Hidden file: C:\WINDOWS\system32\encodex.exe
04/05/06 21:42:48 [Note]: 10002 1
04/05/06 21:42:52 [Info]: Hidden file: C:\WINDOWS\system32\csnse.exe
04/05/06 21:42:52 [Note]: 7002 32
04/05/06 21:42:52 [Note]: 7003 1
04/05/06 21:42:52 [Note]: 10002 1
04/05/06 21:43:33 [Note]: 7007 0

Blacklight Infektionen entfernen lassen

Hijack This
Logfile of HijackThis v1.99.1
Scan saved at 0:27:11, on 6-4-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

O4 - HKLM\..\Run: [exe.vxpmd] C:\WINDOWS\system32\dmpxv.exe

Blacklight nochmal
04/06/06 00:59:46 [Info]: BlackLight Engine 1.0.35 initialized
04/06/06 00:59:46 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/06/06 00:59:46 [Note]: 7019 4
04/06/06 00:59:46 [Note]: 7005 0
04/06/06 00:59:49 [Note]: 7006 0
04/06/06 00:59:49 [Note]: 7011 1380
04/06/06 00:59:50 [Note]: 7026 0
04/06/06 00:59:50 [Note]: 7026 0
04/06/06 00:59:50 [Note]: FSRAW library version 1.7.1015
04/06/06 01:00:15 [Info]: Hidden file: C:\WINDOWS\system32\wbem\wbemtest.exe
04/06/06 01:00:15 [Note]: 10002 1
04/06/06 01:00:24 [Info]: Hidden file: C:\WINDOWS\system32\dmhzp.exe
04/06/06 01:00:24 [Note]: 7002 32
04/06/06 01:00:24 [Note]: 7003 1
04/06/06 01:00:24 [Note]: 10002 1
04/06/06 01:00:31 [Info]: Hidden file: C:\WINDOWS\system32\csnia.exe
04/06/06 01:00:31 [Note]: 7002 32
04/06/06 01:00:31 [Note]: 7003 1
04/06/06 01:00:31 [Note]: 10002 1
04/06/06 01:01:46 [Note]: 7007 0

Und nochmal
04/06/06 01:26:15 [Info]: BlackLight Engine 1.0.35 initialized
04/06/06 01:26:15 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/06/06 01:26:15 [Note]: 7019 4
04/06/06 01:26:15 [Note]: 7005 0
04/06/06 01:26:18 [Note]: 7006 0
04/06/06 01:26:18 [Note]: 7011 1332
04/06/06 01:26:19 [Note]: 7026 0
04/06/06 01:26:19 [Note]: 7026 0
04/06/06 01:26:20 [Note]: FSRAW library version 1.7.1015
04/06/06 01:27:12 [Note]: 7006 0
04/06/06 01:27:12 [Note]: 7011 1332
04/06/06 01:27:13 [Note]: 7026 0
04/06/06 01:27:13 [Note]: 7026 0
04/06/06 01:27:13 [Note]: FSRAW library version 1.7.1015
04/06/06 01:27:54 [Note]: 7007 0

Hijack This
Logfile of HijackThis v1.99.1
Scan saved at 1:28:07, on 6-4-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

O4 - HKLM\..\Run: [exe.pkamd] C:\WINDOWS\system32\dmakp.exe
O4 - HKLM\..\Run: [exe.zxsmd] C:\WINDOWS\system32\dmsxz.exe
O4 - HKLM\..\Run: [exe.sbomd] C:\WINDOWS\system32\dmobs.exe
O4 - HKLM\..\Run: [exe.xkqmd] C:\WINDOWS\system32\dmqkx.exe
O4 - HKLM\..\Run: [exe.pzhmd] C:\WINDOWS\system32\dmhzp.exe
O4 - HKLM\..\Run: [exe.kucmd] C:\WINDOWS\system32\dmcuk.exe
O4 - HKLM\..\Run: [exe.xkamd] C:\WINDOWS\system32\dmakx.exe

Blacklight findet nichts
04/06/06 16:56:23 [Info]: BlackLight Engine 1.0.35 initialized
04/06/06 16:56:23 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/06/06 16:56:23 [Note]: 7019 4
04/06/06 16:56:23 [Note]: 7005 0
04/06/06 16:56:27 [Note]: 7006 0
04/06/06 16:56:27 [Note]: 7011 2216
04/06/06 16:56:27 [Note]: 7026 0
04/06/06 16:56:27 [Note]: 7026 0
04/06/06 16:56:28 [Note]: FSRAW library version 1.7.1015
04/06/06 16:58:16 [Note]: 7007 0

Logfile of HijackThis v1.99.1
Scan saved at 17:02:30, on 6-4-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

O4 - HKLM\..\Run: [exe.xkamd] C:\WINDOWS\system32\dmakx.exe
O4 - HKLM\..\Run: [exe.lflmd] C:\WINDOWS\system32\dmlfl.exe
O4 - HKLM\..\Run: [exe.lzkmd] C:\WINDOWS\system32\dmkzl.exe
O4 - HKLM\..\Run: [exe.yuumd] C:\WINDOWS\system32\dmuuy.exe
O4 - HKLM\..\Run: [exe.fhpmd] C:\WINDOWS\system32\dmphf.exe
O4 - HKLM\..\Run: [exe.vximd] C:\WINDOWS\system32\dmixv.exe
O4 - HKLM\..\Run: [exe.egsmd] C:\WINDOWS\system32\dmsge.exe
O4 - HKLM\..\Run: [exe.lltmd] C:\WINDOWS\system32\dmtll.exe
O4 - HKLM\..\Run: [exe.zxpmd] C:\WINDOWS\system32\dmpxz.exe

Letzter versuch Blacklight
04/06/06 21:33:17 [Info]: BlackLight Engine 1.0.35 initialized
04/06/06 21:33:17 [Info]: OS: 5.1 build 2600 (Service Pack 2)
04/06/06 21:33:17 [Note]: 7019 4
04/06/06 21:33:17 [Note]: 7005 0
04/06/06 21:33:21 [Note]: 7006 0
04/06/06 21:33:21 [Note]: 7011 1276
04/06/06 21:33:22 [Note]: 7026 0
04/06/06 21:33:22 [Note]: 7026 0
04/06/06 21:33:22 [Note]: FSRAW library version 1.7.1015
04/06/06 21:34:09 [Note]: 7007 0

Hijack This
Logfile of HijackThis v1.99.1
Scan saved at 21:25:23, on 6-4-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\eScan\TRAYICOS.EXE
C:\PROGRA~1\eScan\AVPMWrap.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\eScan\TRAYSSER.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\eScan\TRAYICOS.EXE
C:\PROGRA~1\eScan\avpm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\eScan\AvpM.exe
F:\Data download\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MailScan Dispatcher] "C:\Program Files\eScan\LAUNCH.EXE"
O4 - HKLM\..\Run: [eScan Updater] C:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [eScan Monitor] C:\PROGRA~1\eScan\AVPMWrap.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: eScan Server-Updater (eScan-trayicos) - MWTI2 - C:\PROGRA~1\eScan\TRAYSSER.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: eScan Monitor Service (KAVMonitorService) - Kaspersky Labs. - C:\PROGRA~1\eScan\avpm.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
__________
MfG Argus

#7 Arnold

ich wuerde hier noch mit dem Silentrunner arbeiten, denn es muss noch eine reg-Datei erstellt werden.
http://virus-protect.org/silentrunner.html

und das sollte jemand wie du nicht auf dem PC dulden:
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
http://msmvps.com/blogs/spywaresucks/archive/2006/04/07/89702.aspx
__________
MfG Sabina

rund um die PC-Sicherheit

#8 "Silent Runners.vbs", revision 44, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"IncrediMail" = "C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c" ["IncrediMail, Ltd."]
"Skype" = ""C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"SunJavaUpdateSched" = "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"MessengerPlus3" = ""C:\Program Files\MessengerPlus! 3\MsgPlus.exe"" ["Patchou"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"TkBellExe" = ""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot" ["RealNetworks, Inc."]
"APVXDWIN" = ""C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s" ["Panda Software International"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal-pictogramuitbreiding"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Bureaubladverkenner"
-> {HKLM...CLSID} = "Bureaubladverkenner"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}" = "TuneUp Shredder Shell Context Menu Extension"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
"{65756541-C65C-11CD-0000-4B656E696100}" = "Panda Antivirus"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\ShellTit.DLL" ["Panda Software International"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! avldr\DLLName = "avldr.dll" ["Panda Software"]
INFECTION WARNING! wzcnotif\DLLName = "wzcdlg.dll" [MS]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
IMMenuShellExt\(Default) = "{F8984111-38B6-11D5-8725-0050DA2761C4}"
-> {HKLM...CLSID} = "IMMenuShellExt Class"
\InProcServer32\(Default) = "C:\PROGRA~1\INCRED~1\bin\ImShExt.dll" ["IncrediMail, Ltd."]
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\ShellTit.DLL" ["Panda Software International"]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Program Files\ewido\security suite\context.dll" ["ewido networks"]
TuneUp Shredder\(Default) = "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"
-> {HKLM...CLSID} = "TuneUp Shredder Shell Context Menu Extension"
\InProcServer32\(Default) = ""C:\Program Files\TuneUp Utilities 2006\sdshelex.dll"" ["TuneUp Software GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Panda Antivirus\(Default) = "{65756541-C65C-11CD-0000-4B656E696100}"
-> {HKLM...CLSID} = "Panda Antivirus"
\InProcServer32\(Default) = "C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\ShellTit.DLL" ["Panda Software International"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Default executables:
--------------------

HKLM\Software\Classes\.cmd\(Default) = "batfile"


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Martien Hemel\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\system32\ssmarque.scr" [MS]


Startup items in "**" & "All Users" startup folders:
---------------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten
"SiWake" -> shortcut to: "C:\Program Files\Wireless LAN Utility\SiWake.exe" [empty string]


Enabled Scheduled Tasks:
------------------------

"1-Klick-Wartung" -> launches: "C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe /schedulestart" ["TuneUp Software GmbH"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavlsp.dll ["Panda Software International"], 01 - 03, 21
%SystemRoot%\system32\mswsock.dll [MS], 04 - 06, 09 - 20
%SystemRoot%\system32\rsvpsp.dll [MS], 07 - 08


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKCU\Software\Microsoft\Internet Explorer\Explorer Bars\
{21569614-B795-46B1-85F4-E737A8DC09AD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKCU...CLSID} = "Java Plug-in"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]


Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\

Missing lines (compared with English-language version):
HIJACK WARNING! "TuneUp" = "file://C|/Documents and Settings/All Users/Application Data/TuneUp Software/Common/base.css" [file not found]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

ewido security suite control, ewido security suite control, "C:\Program Files\ewido\security suite\ewidoctrl.exe" ["ewido networks"]
ewido security suite guard, ewido security suite guard, "C:\Program Files\ewido\security suite\ewidoguard.exe" ["ewido networks"]
HTTP SSL, HTTPFilter, "C:\WINDOWS\System32\svchost.exe -k HTTPFilter" {"C:\WINDOWS\System32\w3ssl.dll" [MS]}
NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
Panda anti-virus service, PAVSRV, ""C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe"" ["Panda Software International"]
Panda Function Service, PAVFNSVR, ""C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe"" ["Panda Software International"]
Panda IManager Service, PSIMSVC, ""C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe"" ["Panda Software"]
Panda Process Protection Service, PavPrSrv, ""C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe"" ["Panda Software"]
Panda TPSrv, TPSrv, ""C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe"" ["Panda Software"]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 91 seconds, including 16 seconds for message boxes)
__________
MfG Argus

#9 Arnold

funktioniert dein cmd ?

Start -> Ausfuehren -> cmd -- >
__________
MfG Sabina

rund um die PC-Sicherheit

#10 Guten Morgen,Sabina
Die "CMD"ist einwandfrei
CHKDSK konnte ich jetzt auch ausführen,fand auf C 4,5Gb an exe Dateien von ein spiel namens Tycoon
Panda fand auf C:\Windows\System32\process.exe
Eine Partition ist stark Fragmentiert
Von Tune-Up hab ich auch noch RegistryDefrag benutzt

Zitat

und das sollte jemand wie du nicht auf dem PC dulden:

Ich kann nicht alles verbieten,wir sind drei Personen und haben 3 Rechner
Und jeder tut wass er für richtig hält

Gruss
Arnold


__________
MfG Argus

#11 Habe die obengenannten fehler beheben können,aber jetzt ist die videokarte hin
Auf mein zweiten habe ich jetzt ein problem ,ein SVCHOST error führe da jetzt ein MEM test durch mit hilfe von Microsoft
http://oca.microsoft.com/en/windiag.asp
__________
MfG Argus

#12 sieht ganz nach Hardware-Problem aus (RAM hinueber... ueberpruefe die Riegel), Videokarte im Eimer.... ab in einen Computer-Reperaturladen...)

oder eine WindowsKomponente ist korrupt

Start - Ausführen - schreib/kopiere rein:

sfc /scannow

nun wird Windows auf Fehler überprüft.
__________
MfG Sabina

rund um die PC-Sicherheit

#13 Tag,Sabina
Werde ich machen
Symtome:
Windows Mediaplayer funktioniert nicht mehr
Wir haben jetzt noch 2,5 Rechner,werde heute mal auf die suche nach ein neuen Rechner gehen

Gruss
__________
MfG Argus

#14 Es wird wohl die Videokarte sein denn wenn ich etwas ändere bei Bildschirm eigenschaften kommt diese Meldung wieder
Sehe Anhang
Werde Heute mal die Karte testen
Heute bekomme ich auch mein neuen Rechner

Gruss
Arnold


__________
MfG Argus

#15 es gibt inzwischen schon Viren, welche solche Meldungen hervorrufen...aber das nun rauszufinden......
Am besten ist es, erst mal doch bei der Hardware nachzuforschen.....
__________
MfG Sabina

rund um die PC-Sicherheit