iexplore.exe immer an und ständige pop-upsThema ist geschlossen! |
||
|---|---|---|
Thema ist geschlossen! |
||
| #0
| ||
|
01.09.2006, 21:11
...neu hier
Beiträge: 9 |
||
 
|
|
|
|
02.09.2006, 14:35
Ehrenmitglied
 Beiträge: 29434 |
#2
MiG29
der Look2me ist geloescht....nun fehlt noch Swizzor-Trojaner und Naupoint Toolbar 1. Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere den Text, der erscheint Zitat cd\2. Look2Me-Destroyer V1.0.5 -scanne und poste den scanreport http://virus-protect.org/l2mfix.html 3. öffne das HijackThis -- Button "scan" -- vor Eintrage Häkchen setzen -- Button "Fix checked" -- PC neustarten Zitat R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = search.naupoint.comPC neustarten __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.09.2006, 16:11
...neu hier
Themenstarter Beiträge: 9 |
#3
Scanreport von Look2Me-Destroyer:
Look2Me-Destroyer V1.0.12 Scanning for infected files..... Scan started at 06-09-02 15:49:05 Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929507.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929716.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929851.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930087.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930195.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930478.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930537.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936234.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936235.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936236.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936237.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936238.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936240.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936241.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936242.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936243.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936244.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936245.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936246.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936247.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936248.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936249.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936250.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936251.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936252.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936253.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936254.dll Infected! C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936255.dll Attempting to delete infected files... Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929507.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929507.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929716.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929716.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929851.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1929851.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930087.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930087.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930195.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930195.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930478.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930478.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930537.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1930537.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936234.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936234.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936235.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936235.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936236.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936236.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936237.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936237.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936238.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936238.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936240.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936240.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936241.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936241.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936242.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936242.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936243.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936243.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936244.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936244.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936245.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936245.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936246.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936246.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936247.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936247.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936248.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936248.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936249.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936249.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936250.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936250.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936251.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936251.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936252.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936252.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936253.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936253.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936254.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936254.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936255.dll C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP832\A1936255.dll Deleted successfully! Making registry repairs. Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Administratoren - Succeeded |
|
|
|
|
|
|
02.09.2006, 16:12
Ehrenmitglied
Beiträge: 29434 |
#4
Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere den Text, der erscheint
Zitat cd\ __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.09.2006, 16:19
...neu hier
Themenstarter Beiträge: 9 |
#5
Verzeichnis von C:\WINDOWS\Downloaded Program Files
97-10-14 18:52 697 DirectAnimation Java Classes.osd 05-02-09 16:54 1,271 erma.inf 04-07-16 13:20 71,680 iEBINST.dll 05-12-26 15:28 110 iEBINST.ini 04-12-24 19:05 363 iEBINST2.ResultDB 04-12-24 19:05 0 iEBINST2.TaskDB 05-11-03 21:24 495 LegitCheckControl.inf 03-05-29 16:00 160,864 messengerstatsclient.dll 00-01-20 16:25 1,162 Microsoft XML Parser for Java.osd 03-05-29 15:00 84,064 minesweeper.dll 03-05-29 16:00 77,408 msgrchkr.dll 05-05-26 05:19 293 muweb.inf 03-11-05 08:04 228 odyssey_webmoo.inf 04-10-04 16:29 45,568 pdfrpt00.dll - AdWare.BHO.MegaSearch.b 05-08-27 14:30 5,065 swflash.inf 04-12-24 19:05 184 {16E0EBD0-82FB-4CB6-90CC-BC1DCD1AB731} 04-12-24 19:02 0 {ED99AEB6-D1A2-4906-8BD3-98855A8DE5D8} 17 Datei(en) 449,452 Bytes 0 Verzeichnis(se), 9,233,408,000 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Programme\Common Files 05-12-27 02:49 <DIR> . 05-12-27 02:49 <DIR> .. 05-10-28 14:02 <DIR> GTK 04-07-19 22:35 <DIR> Microsoft Shared 0 Datei(en) 0 Bytes 4 Verzeichnis(se), 9,233,408,000 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\Nikolaj 06-09-01 20:09 <DIR> . 06-09-01 20:09 <DIR> .. 06-08-18 21:26 <DIR> .limewire 04-03-01 16:13 <DIR> Application Data 06-08-31 16:44 149 default.pls 06-09-02 15:43 <DIR> Desktop 06-08-25 19:54 <DIR> Eigene Dateien 06-08-16 17:46 14,328 hs_err_pid2956.log 06-08-21 13:50 <DIR> Incomplete 06-09-02 02:55 7,602,176 ntuser.dat 06-08-18 21:46 <DIR> Shared 06-01-10 15:07 <DIR> Startmenu 05-10-06 20:34 <DIR> Startmenu 03-11-22 20:59 <DIR> WINDOWS 3 Datei(en) 7,616,653 Bytes 11 Verzeichnis(se), 9,233,403,904 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Program Files 06-07-27 22:28 <DIR> . 06-07-27 22:28 <DIR> .. 04-05-21 14:39 <DIR> Altnet 04-06-28 15:29 <DIR> CHAOS59.COM 06-07-11 20:53 <DIR> ICQLite 06-07-28 01:29 <DIR> Microsoft Games 05-03-27 16:16 <DIR> Musicmatch 05-01-08 04:00 <DIR> WinRAR 0 Datei(en) 0 Bytes 8 Verzeichnis(se), 9,233,403,904 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\Nikolaj\Lokale Einstellungen\Temp 06-09-02 15:40 <DIR> . 06-09-02 15:40 <DIR> .. 06-09-01 20:39 5,012 ASPNETSetup_00000.log 06-09-01 21:19 <DIR> hsperfdata_Nikolaj 06-09-01 20:57 408 jusched.log 06-09-02 01:09 3,400 mmmxl.log 06-09-01 20:29 658 MSIb195e.LOG 06-09-02 15:39 978 TmpICQMagic_{05736BBE-C20F-4F10-A6DE-4DB1E3564B0E}21848.html 06-09-02 15:39 983 TmpICQMagic_{EC202595-1DFD-4301-A1EA-13C1E331B505}5990.html 06-09-01 20:35 409 WGANotify.settings 06-09-02 15:38 16,384 ~DF1A4A.tmp 06-09-01 20:23 16,384 ~DF2316.tmp 06-09-01 20:24 16,384 ~DFA260.tmp 06-09-01 20:24 16,384 ~DFA336.tmp 06-09-01 20:24 16,384 ~DFA3EA.tmp 06-09-01 20:24 16,384 ~DFA42D.tmp 06-09-01 20:23 16,384 ~DFF4AA.tmp 06-09-02 15:38 16,384 ~DFFBD5.tmp 06-09-02 15:38 512 ~DFFBE6.tmp 16 Datei(en) 143,432 Bytes 3 Verzeichnis(se), 9,233,403,904 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\WINDOWS\Temp 06-09-02 15:39 <DIR> . 06-09-02 15:39 <DIR> .. 06-09-01 20:40 16,384 Perflib_Perfdata_5f8.dat 06-09-01 20:47 0 T30DebugLogFile.txt 06-09-02 15:36 255 WGAErrLog.txt 06-09-02 15:43 409 WGANotify.settings 4 Datei(en) 17,048 Bytes 2 Verzeichnis(se), 9,233,403,904 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Temp 06-09-01 20:03 <DIR> . 06-09-01 20:03 <DIR> .. 0 Datei(en) 0 Bytes 2 Verzeichnis(se), 9,233,403,904 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Programme 06-09-01 19:49 <DIR> . 06-09-01 19:49 <DIR> .. 03-10-30 16:50 <DIR> %ALLUSERSPROFILE% 06-07-06 01:16 <DIR> 1-abc 04-03-15 15:44 <DIR> AC3Filter 05-09-04 21:49 <DIR> Adobe 05-05-16 02:42 <DIR> Ahead 06-01-04 00:21 <DIR> Apollo DivX to DVD Creator 04-11-14 17:30 <DIR> ATI Technologies 06-07-27 20:16 <DIR> Call of Duty 06-08-16 17:15 <DIR> Canon 06-06-28 23:45 <DIR> CDonPC Dumper 06-09-01 19:49 <DIR> CleanUp! 04-10-30 22:14 <DIR> CloneDVD 03-11-17 17:12 <DIR> Comet 05-12-27 02:49 <DIR> Common Files 04-06-07 19:16 <DIR> Creative 03-12-03 20:07 <DIR> directx 06-01-03 17:04 <DIR> inKline Global 0 Datei(en) 0 Bytes 90 Verzeichnis(se), 9,233,399,808 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\Nikolaj\Lokale Einstellungen\Anwendungsdaten 05-04-04 22:13 <DIR> Adobe 04-11-05 13:34 <DIR> Ahead 06-08-22 00:35 <DIR> ApplicationHistory 04-11-14 17:38 <DIR> ATI 06-09-01 16:38 111,616 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 04-01-02 17:51 140 fusioncache.dat 06-08-08 00:38 68,392 GDIPFONTCACHEV1.DAT 04-11-22 17:54 <DIR> Google 03-12-21 21:03 <DIR> Help 04-11-22 16:27 <DIR> HP 03-11-03 18:16 <DIR> Identities 04-07-19 22:37 <DIR> IM 04-11-22 16:27 <DIR> IsolatedStorage 06-04-23 16:36 <DIR> Microsoft 06-07-28 01:38 <DIR> Microsoft Games 05-06-04 16:32 <DIR> NFS Underground 2 06-02-10 16:22 <DIR> Pando 05-07-21 20:44 <DIR> pj-cjd 05-07-21 20:48 <DIR> Stardock 03-11-20 21:26 <DIR> WMTools Downloaded Files 04-04-17 17:18 <DIR> {7148F0A6-6813-11D6-A77B-00B0D0142010} 04-10-21 16:10 <DIR> {7148F0A6-6813-11D6-A77B-00B0D0142040} 3 Datei(en) 180,148 Bytes 19 Verzeichnis(se), 9,233,395,712 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten 05-11-01 00:12 <DIR> .gaim 05-05-12 23:12 <DIR> Adobe 06-06-25 01:42 <DIR> AdobeUM 05-05-16 18:16 <DIR> Ahead 04-11-14 17:38 <DIR> ATI 06-08-16 17:39 <DIR> CD-LabelPrint 06-07-28 19:34 <DIR> dvd mp3 each 06-08-31 16:59 <DIR> dvdcss 06-01-20 16:56 66,752 GDIPFONTCACHEV1.DAT 06-07-24 22:53 <DIR> gpl tool 05-12-27 18:41 <DIR> Help 04-10-31 02:21 <DIR> ICQLite 03-10-30 23:40 <DIR> InterVideo 06-02-08 23:30 <DIR> Lavasoft 04-02-13 19:35 <DIR> Leadertech 04-07-12 21:34 <DIR> Macromedia 05-04-25 00:05 <DIR> Media Player Classic 05-04-16 22:33 <DIR> Opera 06-09-01 02:59 <DIR> Real 06-08-30 00:20 <DIR> SolidDocuments 04-04-17 17:20 <DIR> Sun 03-11-20 23:39 <DIR> Symantec 06-01-31 14:25 <DIR> Tenebril 04-11-05 14:32 <DIR> Unigraphics Solutions 1 Datei(en) 66,752 Bytes 23 Verzeichnis(se), 9,233,395,712 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\All Users\Anwendungsdaten 05-12-26 17:05 <DIR> 2defaulthidebash 06-06-25 01:41 <DIR> Adobe 05-04-04 22:12 <DIR> Adobe Systems 05-05-16 02:42 <DIR> Ahead 04-11-22 16:23 <DIR> Hewlett-Packard 04-11-22 16:28 762 hpzinstall.log 05-12-26 21:30 <DIR> Kaspersky Anti-Virus Personal 05-02-11 15:11 <DIR> Kaspersky Lab 04-10-20 22:14 <DIR> Macrovision 04-05-21 20:24 <DIR> NFS Underground 03-12-21 20:51 <DIR> QuickTime 03-10-15 15:49 <DIR> SBSI 04-09-08 14:09 <DIR> Skype 06-07-18 21:51 <DIR> SolidDocuments 05-06-14 15:24 <DIR> Sony Ericsson 05-12-27 00:03 <DIR> Symantec 03-10-30 17:26 <DIR> T-Online 03-10-30 17:14 <DIR> T-Online_ZusatzSoftware 06-07-24 12:06 <DIR> Trust Third Jump Does 04-07-20 20:49 <DIR> Viewpoint 05-12-27 18:40 <DIR> Windows Genuine Advantage 1 Datei(en) 762 Bytes 20 Verzeichnis(se), 9,233,395,712 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\2defaulthidebash 05-12-26 17:05 <DIR> . 05-12-26 17:05 <DIR> .. 05-12-26 17:05 364,310 IdolThe.exe 1 Datei(en) 364,310 Bytes 2 Verzeichnis(se), 9,233,395,712 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does 06-07-24 12:06 <DIR> . 06-07-24 12:06 <DIR> .. 06-05-02 12:10 365,403 1army.exe 06-07-24 12:06 368,582 ante soft.exe 06-05-01 17:23 365,403 Build log.exe 06-07-24 12:03 368,582 Itch find.exe 06-04-30 16:37 365,403 Loud 2.exe 5 Datei(en) 1,833,373 Bytes 2 Verzeichnis(se), 9,233,395,712 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Programme\Gemeinsame Dateien 06-09-01 20:30 <DIR> . 06-09-01 20:30 <DIR> .. 05-05-18 13:31 <DIR> Adobe 05-04-04 22:12 <DIR> Adobe Systems Shared 04-11-05 00:25 <DIR> Ahead 03-10-15 15:50 <DIR> Designer 03-10-15 15:44 <DIR> Dienste 03-12-30 18:54 <DIR> DirectX 04-11-22 16:20 <DIR> HP 03-11-04 21:47 <DIR> InstallShield 04-06-07 19:18 <DIR> InterVideo 04-04-17 17:19 <DIR> Java 04-09-27 13:19 <DIR> Logitech 04-10-20 22:14 <DIR> Macrovision Shared 04-11-22 16:23 <DIR> Microsoft Shared 03-10-15 15:44 <DIR> MSSoap 04-10-05 20:09 <DIR> NSV 06-09-01 20:30 <DIR> ODBC 06-09-01 03:02 <DIR> Real 03-10-15 16:41 <DIR> SpeechEngines 06-04-14 15:01 <DIR> stardock 05-12-27 00:32 <DIR> Symantec Shared 06-09-01 20:28 <DIR> System 05-06-14 15:24 <DIR> Teleca Shared 03-11-19 00:53 <DIR> Totem Shared 0 Datei(en) 0 Bytes 25 Verzeichnis(se), 9,233,391,616 Bytes frei Datentrager in Laufwerk C: ist 53_01_02 Volumeseriennummer: A4CD-BFB1 Verzeichnis von C:\Windows\tasks 06-09-01 23:09 352 Symantec NetDetect.job 1 Datei(en) 352 Bytes 0 Verzeichnis(se), 9,233,391,616 Bytes frei |
|
|
|
|
|
|
02.09.2006, 18:04
Ehrenmitglied
Beiträge: 29434 |
#6
Avenger
http://virus-protect.org/artikel/tools/avenger.html kopiere rein: Zitat Files to delete:Klicke die gruene Ampel das Script wird nun ausgeführt, dann wird der PC automatisch neustarten * poste das log vom avenger, was nach neustart erscheint ** loesche: C:\Programme\Gemeinsame Dateien\Totem Shared ** Arbeitsplatz-->Rechtsklick, dann auf Eigenschaften--->Reiter Systemwiederherstellung--->Häkchen setzen bei Systemwiederherstellung auf allen Laufwerken deaktivieren. (dann wieder aktivieren) ** scanne und poste den scanreport http://virus-protect.org/cureit.html ** neue Startseite gehe zur Systemsteuerung --> Internetoptionen --> auf dem Reiter Allgemein bei Temporäre Internetdateien klickst du Dateien löschen --> auch bei Alle Offlineinhalte löschen das Häkchen setzen und mit OK bestätigen --> Auf den Reiter Programme gehen und dort auf Webeinstellungen zurücksetzen klicken, mit Ja bestätigen, fall Nachfrage kommt --> auf Übernehmen und abschließend auf OK klicken und stelle eine neue Startseite ein ** poste das neue Log vom HijckTHis __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.09.2006, 20:19
...neu hier
Themenstarter Beiträge: 9 |
#7
Logfile of The Avenger version 1, by Swandog46
Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\rsspwuty ******************* Script file located at: \??\C:\Program Files\lukbflgx.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\tasks\A843C3EA91807A9E.job deleted successfully. File C:\WINDOWS\Downloaded Program Files\iEBINST.dll not found! Deletion of file C:\WINDOWS\Downloaded Program Files\iEBINST.dll failed! Could not process line: C:\WINDOWS\Downloaded Program Files\iEBINST.dll Status: 0xc0000034 File C:\WINDOWS\Downloaded Program Files\iEBINST.ini deleted successfully. File C:\WINDOWS\Downloaded Program Files\iEBINST2.ResultDB deleted successfully. File C:\WINDOWS\Downloaded Program Files\iEBINST2.TaskDB deleted successfully. File C:\WINDOWS\Downloaded Program Files\{16E0EBD0-82FB-4CB6-90CC-BC1DCD1AB731} deleted successfully. File C:\WINDOWS\Downloaded Program Files\{ED99AEB6-D1A2-4906-8BD3-98855A8DE5D8} deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\1army.exe deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\ante soft.exe deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\Build log.exe deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\Itch find.exe deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\Loud 2.exe deleted successfully. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\2defaulthidebash\IdolThe.exe deleted successfully. Completed script processing. ******************* Finished! Terminate. DR.WEB fzthkooz.exe;C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\dvd mp3 each;Trojan.Swizzor;Incurable.Moved.; hotnlrbu.exe;C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\dvd mp3 each;Trojan.Swizzor;Incurable.Moved.; qslevmuf.exe;C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\dvd mp3 each;Trojan.Swizzor;Incurable.Moved.; uonwzxmw.exe;C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\dvd mp3 each;Trojan.Swizzor;Deleted.; wjluatia.exe;C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\dvd mp3 each;Trojan.Swizzor;Deleted.; A0000771.exe;C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1;Trojan.Swizzor;Incurable.Moved.; A0000772.exe;C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1;Trojan.Swizzor;Incurable.Moved.; A0000773.exe;C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1;Trojan.Swizzor;Incurable.Moved.; A0000774.exe;C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1;Trojan.Swizzor;Deleted.; A0000775.exe;C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1;Trojan.Swizzor;Deleted.; icont.exe;C:\WINDOWS;Adware.AddUrl;; NDNuninstall6_98.exe;C:\WINDOWS;Adware.NewDotNet;; arxsetup.exe;C:\Works;Probably DLOADER.Trojan;; Logfile of HijackThis v1.99.1 Scan saved at 20:21, on 06-09-02 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\ATI-CPanel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe C:\Programme\Logitech\iTouch\iTouch.exe C:\Programme\HP\hpcoretech\hpcmpmgr.exe C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\Programme\Java\jre1.5.0_06\bin\jusched.exe C:\Programme\HP\HP Software Update\HPWuSchd2.exe C:\Programme\inKline Global\PC Booster\pcbooster.exe C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe C:\Programme\SpyCatcher\DeleteSatellite.exe C:\Programme\Logitech\MouseWare\system\em_exec.exe C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WgaTray.exe C:\WINDOWS\System32\taskmgr.exe C:\Programme\Opera\Opera.exe C:\Dokumente und Einstellungen\Nikolaj\Desktop\1111\drweb-cureit.exe C:\DOKUME~1\Nikolaj\LOKALE~1\Temp\RarSFX0\_start.exe C:\DOKUME~1\Nikolaj\LOKALE~1\Temp\RarSFX0\cureit.exe C:\Programme\ICQLite\ICQLite.exe C:\WINDOWS\System32\wuauclt.exe C:\Dokumente und Einstellungen\Nikolaj\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe \RESET O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [mmtask] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - HKLM\..\Run: [PC Booster] C:\Programme\inKline Global\PC Booster\pcbooster.exe O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe" O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe" nowait O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Alles mit FlashGet laden - C:\Dokumente und Einstellungen\Nikolaj\Eigene Dateien\FlashGet\jc_all.htm O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Mit FlashGet laden - C:\Dokumente und Einstellungen\Nikolaj\Eigene Dateien\FlashGet\jc_link.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOKUME~1\Nikolaj\Desktop\FlashGet\flashget.exe (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOKUME~1\Nikolaj\Desktop\FlashGet\flashget.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135702263750 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://playroom.icq.com/odyssey_web11.cab O18 - Protocol: bw+0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: offline-8876480 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe |
|
|
|
|
|
|
02.09.2006, 21:43
Ehrenmitglied
Beiträge: 29434 |
#8
Start > Ausfuehren --> reinschreiben --> cmd.exe
und ok. kopiere rein und poste alles, was im Texteditor erscheint dir /s /a "c:\arxsetup*.*" > c:\find.txt & start notepad c:\find.txt « __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.09.2006, 22:57
...neu hier
Themenstarter Beiträge: 9 |
#9
Datentrager in Laufwerk C: ist 53_01_02
Volumeseriennummer: A4CD-BFB1 Verzeichnis von c:\Works 01-05-24 16:35 483,328 arxsetup.exe 01-04-26 17:02 7,898 arxsetup.ini 2 Datei(en) 491,226 Bytes Anzahl der angezeigten Dateien: 2 Datei(en) 491,226 Bytes 0 Verzeichnis(se), 14,932,144,128 Bytes frei |
|
|
|
|
|
|
03.09.2006, 00:47
Ehrenmitglied
Beiträge: 29434 |
#10
virustotal
Oben auf der Seite --> auf Durchsuchen klicken --> mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten http://www.virustotal.com/flash/index_en.html c:\Works\arxsetup.exe poste den bericht __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
03.09.2006, 00:54
...neu hier
Themenstarter Beiträge: 9 |
#11
AntiVir 7.1.1.11 09.01.2006 no virus found
Authentium 4.93.8 09.02.2006 no virus found Avast 4.7.844.0 09.01.2006 no virus found AVG 386 09.01.2006 no virus found BitDefender 7.2 09.03.2006 no virus found CAT-QuickHeal 8.00 09.02.2006 no virus found ClamAV devel-20060426 09.02.2006 no virus found DrWeb 4.33 09.02.2006 DLOADER.Trojan eTrust-InoculateIT 23.72.113 09.01.2006 no virus found eTrust-Vet 30.3.3056 09.01.2006 no virus found Ewido 4.0 09.02.2006 no virus found Fortinet 2.77.0.0 09.02.2006 no virus found F-Prot 3.16f 09.01.2006 no virus found F-Prot4 4.2.1.29 09.01.2006 no virus found Ikarus 0.2.65.0 09.02.2006 no virus found Kaspersky 4.0.2.24 09.03.2006 no virus found McAfee 4843 09.01.2006 no virus found Microsoft 1.1560 09.02.2006 no virus found NOD32v2 1.1736 09.02.2006 no virus found Norman 5.90.23 09.01.2006 no virus found Panda 9.0.0.4 09.02.2006 no virus found Sophos 4.09.0 09.02.2006 no virus found Symantec 8.0 09.02.2006 no virus found TheHacker 5.9.8.203 09.01.2006 no virus found UNA 1.83 09.02.2006 no virus found VBA32 3.11.1 09.01.2006 no virus found VirusBuster 4.3.7:9 09.02.2006 no virus found Aditional Information File size: 483328 bytes MD5: cb02ef686729f497b699b83c3fdbdb99 SHA1: a97fc94ee346ecc23ab11083aa712240766f3be1 |
|
|
|
|
|
|
03.09.2006, 01:28
Ehrenmitglied
Beiträge: 29434 |
#12
ich mag es nicht glauben, dass das ein Trojaner ist:
schon allein das Installations-Datum  -> 2001 .. eventuell ist es ein Bug vom Dr.Web.Verzeichnis von c:\Works 01-05-24 16:35 483,328 arxsetup.exe 01-04-26 17:02 7,898 arxsetup.ini scanne mit Panda und poste den scanreport http://virus-protect.org/onlinescan.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
03.09.2006, 01:43
...neu hier
Themenstarter Beiträge: 9 |
#13
hmm... also soll ich arxsetup.exe und arxsetup.ini mit avenger löschen oder nicht!? Ist auch komisch, dass es nur Dr.Web als trojaner erkennt und alle anderen antiviren progs nichts dazu sagen :-~
mitm Panda geht der scan leider nicht, es steht unten "Fehler auf der Seite" und das wars. |
|
|
|
|
|
|
03.09.2006, 12:08
Ehrenmitglied
Beiträge: 29434 |
#14
waehle einen anderen scanner - Bitdefender/Online
http://virus-protect.org/onlinescan.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
03.09.2006, 20:35
...neu hier
Themenstarter Beiträge: 9 |
#15
der bericht von BitDefender:
C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\file\Counter.class-762d722b-128199a3.class Infiziert: Trojan.Downloader.Small.WV C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\file\Counter.class-762d722b-128199a3.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\file\Counter.class-762d722b-128199a3.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-410e9c06-28b014c8.zip=>Gummy.class Infiziert: Java.Trojan.Exploit.Bytverify C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-410e9c06-28b014c8.zip=>Gummy.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-410e9c06-28b014c8.zip=>Gummy.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-410e9c06-28b014c8.zip Aktualisiert C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-75c822bf-71139391.zip=>Gummy.class Infiziert: Java.Trojan.Exploit.Bytverify C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-75c822bf-71139391.zip=>Gummy.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-75c822bf-71139391.zip=>Gummy.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\ar3.jar-75c822bf-71139391.zip Aktualisiert C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-13554ce9.zip=>Dummy.class Infiziert: Trojan.Java.Byteverify.B C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-13554ce9.zip=>Dummy.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-13554ce9.zip=>Dummy.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-13554ce9.zip Aktualisiert C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-2eed4dc5.zip=>Dummy.class Infiziert: Trojan.Java.Byteverify.B C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-2eed4dc5.zip=>Dummy.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-2eed4dc5.zip=>Dummy.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-420d6bd5-2eed4dc5.zip Aktualisiert C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv65.jar-15645771-173c4637.zip=>Dummy.class Infiziert: Trojan.Java.Classloader.G C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv65.jar-15645771-173c4637.zip=>Dummy.class Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv65.jar-15645771-173c4637.zip=>Dummy.class Gelöscht C:\Dokumente und Einstellungen\Nikolaj\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\loaderadv65.jar-15645771-173c4637.zip Aktualisiert C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000771.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000771.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000771.exe Gelöscht C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000772.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000772.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000772.exe Gelöscht C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000773.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000773.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\A0000773.exe Gelöscht C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\fzthkooz.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\fzthkooz.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\fzthkooz.exe Gelöscht C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\hotnlrbu.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\hotnlrbu.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\hotnlrbu.exe Gelöscht C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\qslevmuf.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\qslevmuf.exe Desinfektion fehlgeschlagen C:\Dokumente und Einstellungen\Nikolaj\DoctorWeb\Quarantine\qslevmuf.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/1army.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/1army.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/1army.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/ante soft.exe Infiziert: GenPack:Trojan.Swizzor.IA C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/ante soft.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/ante soft.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Build log.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Build log.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Build log.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/IdolThe.exe Infiziert: GenPack:Trojan.Downloader.Swizzor.S C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/IdolThe.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/IdolThe.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Itch find.exe Infiziert: GenPack:Trojan.Swizzor.IA C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Itch find.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Itch find.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Loud 2.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Loud 2.exe Desinfektion fehlgeschlagen C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip=>avenger/Loud 2.exe Gelöscht C:\RECYCLER\S-1-5-21-740712121-307422556-2250009542-1006\Dc2.zip Aktualisiert C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0008256.exe Infiziert: Trojan.ProcKill.DJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0008256.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0008267.exe Infiziert: Trojan.Qurl.3 C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0008267.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0008267.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022235.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022235.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022235.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022236.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022236.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022236.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022237.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022237.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022237.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022238.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022238.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022238.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022239.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022239.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022239.exe Gelöscht C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022240.exe Infiziert: GenPack:Trojan.Swizzor.HJ C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022240.exe Desinfektion fehlgeschlagen C:\System Volume Information\_restore{6F73CD4F-23AF-447D-8FD7-6522AFC764EC}\RP1\A0022240.exe Gelöscht C:\WINDOWS\country.exe Infiziert: Trojan.ProcKill.DJ C:\WINDOWS\country.exe Gelöscht C:\WINDOWS\icont.exe Infiziert: Trojan.Qurl.3 C:\WINDOWS\icont.exe Desinfektion fehlgeschlagen C:\WINDOWS\icont.exe Gelöscht |
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
habe ein problem mitm Internet Explorer. ich benutze Opera, aber iexplore.exe ist immer unter den prozessen dabei, abschalten geht nicht, es komm nach ein paar sekunden wieder. außerdem kommen immer nervende pop-ups.
was kann es sein? und wie kann ich in dem fall vorgehen?
danke
Logfile of HijackThis v1.99.1
Scan saved at 21:02, on 06-09-01
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\inKline Global\PC Booster\pcbooster.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programme\SpyCatcher\DeleteSatellite.exe
C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Programme\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Dokumente und Einstellungen\Nikolaj\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = search.naupoint.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = search.naupoint.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = search.naupoint.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.naupoint.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = search.naupoint.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: (no name) - {83C358D4-E34F-CB31-EBD1-33364F893AE3} - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe \RESET
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [mmtask] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HideBashModePop] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\2defaulthidebash\IdolThe.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [PC Booster] C:\Programme\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programme\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [Jump Does Site One] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Trust Third Jump Does\ante soft.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Programme\SpyCatcher\DeleteSatellite.exe" nowait
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Alles mit FlashGet laden - C:\Dokumente und Einstellungen\Nikolaj\Eigene Dateien\FlashGet\jc_all.htm
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Mit FlashGet laden - C:\Dokumente und Einstellungen\Nikolaj\Eigene Dateien\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOKUME~1\Nikolaj\Desktop\FlashGet\flashget.exe (file missing)
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\DOKUME~1\Nikolaj\Desktop\FlashGet\flashget.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {0036F389-FEF8-43AC-9220-16430E0012ED} (No description) - http://naupoint.com/toolbar/installer/iEBINST6.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1135702263750
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://playroom.icq.com/odyssey_web11.cab
O18 - Protocol: bw+0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {1703B58F-832F-4DA5-8A63-8DF8B22B62B6} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Programme\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
system32.txt:
06-09-01 20:48 1,158 wpa.dbl
06-09-01 20:47 18,432 sporder.dll
06-09-01 20:39 402,406 perfh009.dat
06-09-01 20:39 63,016 perfc009.dat
06-09-01 20:39 416,942 perfh007.dat
06-09-01 20:39 75,864 perfc007.dat
06-09-01 20:39 931,436 PerfStringBackup.INI
06-08-09 12:03 8,325,544 MRT.exe
06-08-04 20:06 463,360 URLMON.DLL
06-08-03 21:32 45 initdebug.nfo
06-07-21 10:29 72,704 hlink.dll
06-07-18 21:56 34,308 BASSMOD.dll
06-07-14 17:57 307,200 netapi32.dll
06-07-14 17:36 519,168 hhctrl.ocx
06-07-13 15:50 8,394,240 shell32.dll
06-07-13 10:51 612,864 xpsp2res.dll
06-07-05 12:53 1,002,496 kernel32.dll
06-07-01 21:00 21,840 SIntfNT.dll
06-07-01 21:00 17,212 SIntf32.dll
06-07-01 21:00 12,067 SIntf16.dll
06-06-30 10:51 2,703,872 MSHTML.DLL
06-06-26 19:47 140,288 dnsapi.dll
06-06-26 19:47 6,144 rasadhlp.dll
06-06-23 13:27 582,144 WININET.DLL
06-06-22 12:59 169,984 rasmans.dll
06-06-19 16:20 702,768 WgaLogon.dll
06-06-19 16:19 571,184 LegitCheckControl.dll
06-06-19 16:19 304,944 WgaTray.exe
06-06-09 14:35 351,744 DXTMSFT.DLL
06-06-09 14:35 192,512 DXTRANS.DLL
06-06-01 22:20 247,104 FNTCACHE.DAT
06-05-26 22:19 163,840 JGDW400.DLL
06-05-26 15:49 1,339,904 SHDOCVW.DLL
06-05-19 14:13 84,480 iphlpapi.dll
06-05-19 14:13 54,272 ipv6mon.dll
06-05-19 14:13 70,656 ws2_32.dll
06-05-19 14:13 13,312 wship6.dll
06-05-19 14:13 104,448 dhcpcsvc.dll
06-05-19 14:13 31,232 inetmib1.dll
06-05-19 14:13 95,232 6to4svc.dll
06-05-19 14:01 48,640 ipv6.exe
06-05-19 14:01 85,504 netsh.exe
06-05-19 10:51 184,320 xpob2res.dll
06-05-18 08:13 458,752 jscript.dll
06-05-16 22:23 339,968 pxwave.dll
06-05-16 22:23 28,672 vxblock.dll
06-05-16 22:23 450,560 pxdrv.dll
06-05-16 22:23 56,832 pxinsa64.exe
06-05-16 22:23 1,257,472 pxsfs.dll
06-05-16 22:23 57,344 pxcpya64.exe
06-05-16 22:23 61,440 pxhpinst.exe
06-05-16 22:23 176,128 pxmas.dll
06-05-16 22:23 430,080 px.dll
06-05-14 11:26 368,128 ipsmsnap.dll
06-05-14 11:26 161,280 ipsecsvc.dll
06-05-14 11:26 346,624 ipsecsnp.dll
06-05-14 11:26 29,184 winipsec.dll
06-05-14 11:26 98,816 polstore.dll
06-05-14 11:26 258,560 oakley.dll
systemtemp.txt:
Datentrager in Laufwerk C: ist 53_01_02
Volumeseriennummer: A4CD-BFB1
Verzeichnis von C:\DOKUME~1\Nikolaj\LOKALE~1\Temp
06-09-01 20:57 408 jusched.log
06-09-01 20:39 5,012 ASPNETSetup_00000.log
06-09-01 20:35 409 WGANotify.settings
06-09-01 20:29 658 MSIb195e.LOG
06-09-01 20:24 16,384 ~DFA42D.tmp
06-09-01 20:24 16,384 ~DFA3EA.tmp
06-09-01 20:24 16,384 ~DFA336.tmp
06-09-01 20:24 16,384 ~DFA260.tmp
06-09-01 20:23 16,384 ~DF2316.tmp
06-09-01 20:23 16,384 ~DFF4AA.tmp
10 Datei(en) 104,791 Bytes
0 Verzeichnis(se), 9,531,744,256 Bytes frei
system.txt:
Datentrager in Laufwerk C: ist 53_01_02
Volumeseriennummer: A4CD-BFB1
Verzeichnis von C:\WINDOWS
06-09-01 20:54 1,623,277 WindowsUpdate.log
06-09-01 20:47 982,306 setupapi.log
06-09-01 20:47 0 0.log
06-09-01 20:47 50 wiaservc.log
06-09-01 20:47 1,409 spupdsvc.log
06-09-01 20:47 4,032 ModemLog_Smart Link 56K Modem.txt
06-09-01 20:47 159 wiadebug.log
06-09-01 20:47 65 iTouch.ini
06-09-01 20:46 2,048 bootstat.dat
06-09-01 20:45 32,460 SchedLgU.Txt
06-09-01 20:44 159,575 ntdtcsetup.log
06-09-01 20:44 260,950 comsetup.log
06-09-01 20:44 117,168 iis6.log
06-09-01 20:44 298,924 tsoc.log
06-09-01 20:44 39,801 KB917734.log
06-09-01 20:44 1,355 imsins.log
06-09-01 20:44 475,590 wmsetup.log
06-09-01 20:44 27,047 ocmsn.log
06-09-01 20:44 403,075 ocgen.log
06-09-01 20:44 37,707 msgsocm.log
06-09-01 20:44 766,674 FaxSetup.log
06-09-01 20:43 42,951 KB921883.log
06-09-01 20:43 1,355 imsins.BAK
06-09-01 20:43 41,740 updspapi.log
06-09-01 20:42 41,918 KB911927.log
06-09-01 20:42 41,619 KB922616.log
06-09-01 20:42 33,693 KB918899-IE6SP1-20060725.123917.log
06-09-01 20:41 41,396 KB911280.log
06-09-01 20:37 29,524 KB917159.log
06-09-01 20:36 22,877 KB914798.log
06-09-01 20:36 46,896 MDAC28-KB911562-x86-DEU.log
06-09-01 20:35 25,003 WgaNotify.log
06-09-01 20:34 31,488 KB921398.log
06-09-01 20:34 20,195 KB918439-IE6SP1-20060530.145346.log
06-09-01 20:33 25,275 KB911564.log
06-09-01 20:31 29,255 KB920670.log
06-09-01 20:31 29,945 KB914388.log
06-09-01 20:31 18,242 KB917344.log
06-09-01 20:31 17,745 KB917953.log
06-09-01 20:30 18,364 KB917422.log
06-09-01 20:29 17,162 KB912919.log
06-09-01 20:28 10,005 KB911567-OE6SP1-20060316.165634.log
06-09-01 20:27 21,223 KB908531.log
06-09-01 20:26 16,877 KB913580.log
06-09-01 20:26 14,681 KB908519.log
06-09-01 20:26 16,175 KB920683.log
06-09-01 20:26 15,469 KB914389.log
06-09-01 16:38 116 NeroDigital.ini
06-09-01 01:36 54,156 QTFont.qfn
06-08-31 16:44 67 #1 DVD Ripper.INI
06-08-29 20:06 1,409 QTFont.for
06-08-19 17:36 545,148 svcpack.log
06-08-04 20:39 28,500 DPINST.LOG
06-08-02 21:29 0 Facher.bmp
06-07-28 19:44 180 setupact.log
06-07-27 19:11 766 CoD.INI
06-07-18 21:59 167 ConverterCore.INI
06-07-01 22:07 1,373 DirectX.log
06-07-01 21:07 25 SIERRA.INI
366 Datei(en) 36,878,305 Bytes
0 Verzeichnis(se), 9,531,711,488 Bytes frei
sys.txt:
Datentrager in Laufwerk C: ist 53_01_02
Volumeseriennummer: A4CD-BFB1
Verzeichnis von C:\
06-09-01 21:07 0 sys.txt
06-09-01 21:07 18,230 system.txt
06-09-01 21:07 728 systemtemp.txt
06-09-01 21:07 2,780 system32-1.txt
06-09-01 21:05 101,140 system32.txt
06-09-01 20:46 536,399,872 hiberfil.sys
06-09-01 20:46 805,306,368 pagefile.sys
06-09-01 20:21 13,125 ComboFix.txt
06-08-31 16:17 42,202 debug.log
06-08-13 16:14 277 debugInstaller.txt
06-03-15 20:37 0 itouch_config_crash_info.txt
25 Datei(en) 1,342,183,367 Bytes
0 Verzeichnis(se), 9,531,719,680 Bytes frei
((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))
REGISTRY ENTRIES REMOVED:
[HKEY_CLASSES_ROOT\CLSID\{BFC97D7C-16D6-470E-913E-D2204CB8A8A4}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BFC97D7C-16D6-470E-913E-D2204CB8A8A4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BFC97D7C-16D6-470E-913E-D2204CB8A8A4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{BFC97D7C-16D6-470E-913E-D2204CB8A8A4}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{57EF8BC3-519D-46D7-BF7E-A1EE730E3E62}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{57EF8BC3-519D-46D7-BF7E-A1EE730E3E62}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{57EF8BC3-519D-46D7-BF7E-A1EE730E3E62}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{57EF8BC3-519D-46D7-BF7E-A1EE730E3E62}\InprocServer32]
@="C:\\WINDOWS\\system32\\FG20DEU.DLL"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{7C08B7C7-F154-465F-B110-66944488A6A6}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7C08B7C7-F154-465F-B110-66944488A6A6}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7C08B7C7-F154-465F-B110-66944488A6A6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{7C08B7C7-F154-465F-B110-66944488A6A6}\InprocServer32]
@="C:\\WINDOWS\\system32\\myjetoledb40.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{F367EF6C-E975-4E53-8992-BE80A316FA45}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F367EF6C-E975-4E53-8992-BE80A316FA45}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F367EF6C-E975-4E53-8992-BE80A316FA45}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F367EF6C-E975-4E53-8992-BE80A316FA45}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{0C428FB8-ED83-404D-A9C4-ED7D363FF955}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0C428FB8-ED83-404D-A9C4-ED7D363FF955}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0C428FB8-ED83-404D-A9C4-ED7D363FF955}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0C428FB8-ED83-404D-A9C4-ED7D363FF955}\InprocServer32]
@="C:\\WINDOWS\\system32\\ripcfgex.dll"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{390E2789-6F87-4D11-A01F-5E6C4DCE3004}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{390E2789-6F87-4D11-A01F-5E6C4DCE3004}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{390E2789-6F87-4D11-A01F-5E6C4DCE3004}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{390E2789-6F87-4D11-A01F-5E6C4DCE3004}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
[HKEY_CLASSES_ROOT\CLSID\{2C85911A-59CD-4982-A29A-87F631BB6935}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{2C85911A-59CD-4982-A29A-87F631BB6935}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{2C85911A-59CD-4982-A29A-87F631BB6935}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{2C85911A-59CD-4982-A29A-87F631BB6935}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
FILES REMOVED:
C:\WINDOWS\system32\avptif.dll
C:\WINDOWS\system32\azao0193e.dll
C:\WINDOWS\system32\dnro0193e.dll
C:\WINDOWS\system32\en2ql1f51.dll
C:\WINDOWS\system32\ewcapi.dll
C:\WINDOWS\system32\FG20DEU.DLL
C:\WINDOWS\system32\fgsdrv.dll
C:\WINDOWS\system32\g6400ghme64a0.dll
C:\WINDOWS\system32\jycript.dll
C:\WINDOWS\system32\kgdycc.dll
C:\WINDOWS\system32\m8po0i73e8.dll
C:\WINDOWS\system32\mhfutil.dll
C:\WINDOWS\system32\mjiwave.dll
C:\WINDOWS\system32\mlrdim.dll
C:\WINDOWS\system32\moisip.dll
C:\WINDOWS\system32\mv48l9hu1.dll
C:\WINDOWS\system32\myjetoledb40.dll
C:\WINDOWS\system32\p08q0al5edq.dll
C:\WINDOWS\system32\pgtorec.dll
C:\WINDOWS\system32\q0psla771d.dll
C:\WINDOWS\system32\ripcfgex.dll
C:\WINDOWS\system32\untheme.dll
C:\WINDOWS\system32\guard.tmp
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\A843C3EA91807A9E.job
C:\WINDOWS\tasks\Symantec NetDetect.job
Completion time: 06-09-01 20:21:27.10
ComboFix.txt