SpySheriff - escan sagt ja / andere nein

#1 Hallo,

ich bin neu hier, habe aber frueher schon mal reingeschaut.


Zum Problem:


Von Zeit zu Zeit läuft e-san.
Gestern brach es durch Stromausfall ab, meldete vorher jedoch einen Fund.
Ein späterer Scan bestätigte ihn.


Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({39fda070-61ba-11d2-ad84-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({a1eedaa7-c4d8-11d2-ad9c-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ca4fc24b-c65c-11d1-aa6f-000000000000})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ddd136ce-517b-11d2-ad03-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({4f99a075-5227-11d2-ad06-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({371d0743-7a57-11d2-ad5a-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({e9d55102-9683-11d2-ba68-0040053687fe})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({0c1f87ae-ae62-11d3-911c-00105a17b608})! Action taken: No Action Taken.
Wed Sep 13 12:40:02 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({b22fe43c-d1e8-432a-a862-9f83d5f04732})! Action taken: No Action Taken.
Wed Sep 13 12:40:49 2006 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger (DartSock.dll)! Action taken: No Action Taken.
Wed Sep 13 12:44:03 2006 => Scanning Folder: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic\INFECTED\*.*
Wed Sep 13 13:14:02 2006 => Scanning File C:\Programme\a-squared Free\infected.txt
Wed Sep 13 13:14:11 2006 => Scanning File C:\Programme\a2 free\infected.txt
Wed Sep 13 14:04:38 2006 => Total Disinfected Files: 0

Funde für "tagged"




Ich habe dann AntiVir, a², Spybot und AdAware laufen lassen - ohne Funde.

Heute habe ich mich von AntiVir getrennt und Kaspersky AV Personal installiert.
(Kaspersky und e-scan sind einander aehnlich?)

Kaspersky findet jedenfalls auch nichts.
(nicht im abgesicherten Modus)


Es wäre schön, wenn Ihr mir helfen könntet.


Hier einige Logs:



Logfile of HijackThis v1.99.1
Scan saved at 00:17:20, on 14.09.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Dokumente und Einstellungen\**\Desktop\hijackthis 2\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:/www.google.de
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 218.18.101.97:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Toolbar\01.01.1601.0\de\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [Trojancheck 6 Guard] C:\Programme\Trojancheck 6\tcguard.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus DX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /M "Stylus DX4200" /EF "HKCU"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1119022927161
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.de/scan/Msie/bitdefender.cab
O23 - Service: EPSON V3 Service2(03) (EPSON_PM_RPCV2_01) - SEIKO EPSON CORPORATION - C:\WINDOWS\System32\E_S00RP1.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\System32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Epson Printer Status Agent4 (StatusAgent4) - SEIKO EPSON CORPORATION - C:\WINDOWS\System32\SAgent4.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe





"Silent Runners.vbs", revision 48, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\System32\ctfmon.exe" [MS]
"EPSON Stylus DX4200 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /M "Stylus DX4200" /EF "HKCU"" ["SEIKO EPSON CORPORATION"]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++}
"SystemManager" = "C:\WINDOWS\System32\msacm32.exe" [file not found]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Trojancheck 6 Guard" = "C:\Programme\Trojancheck 6\tcguard.exe" [empty string]
"KernelFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -k" [MS]
"SunJavaUpdateSched" = "C:\Programme\Java\jre1.5.0_06\bin\jusched.exe" ["Sun Microsystems, Inc."]
"Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS]
"EPSON Stylus DX4200 Series" = "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEE.EXE /P26 "EPSON Stylus DX4200 Series" /O6 "USB001" /M "Stylus DX4200"" ["SEIKO EPSON CORPORATION"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit" [MS]
"Zone Labs Client" = ""C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs, LLC"]
"KAVPersonal50" = ""C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kav.exe" /minimize" ["Kaspersky Lab"]
"OESpamTest" = "C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE" ["Ashmanov & Partners"]

HKLM\Software\Microsoft\Active Setup\Installed Components\
{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
\StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Programme\Messenger\msgsc.dll",ShowIconsUser" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
-> {HKLM...CLSID} = "SSVHelper Class"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\ssv.dll" ["Sun Microsystems, Inc."]
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}\(Default) = (no title provided)
-> {HKLM...CLSID} = "EpsonToolBandKicker Class"
\InProcServer32\(Default) = "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Microsoft Office\Office10\msohev.dll" [MS]
"{CA5FEE26-14C1-4B5A-86E9-233FC0EE2682}" = "IZArc DragDrop Menu"
-> {HKLM...CLSID} = "IZArc DragDrop Menu"
\InProcServer32\(Default) = "C:\Programme\IZArc\IZArcCM.dll" [null data]
"{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}" = "IZArc Shell Context Menu"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\Programme\IZArc\IZArcCM.dll" [null data]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{A155339D-CCCD-4714-85EB-3754B804C9DF}" = "a-squared Free Context Menu Shell Extension"
-> {HKLM...CLSID} = "a-squared Free Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]
"{B28C18DB-6816-4F31-9630-397683E3C2C3}" = "Filzip Shell Extension"
-> {HKLM...CLSID} = "Filzip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Filzip\fzshext.dll" [empty string]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "PDBoot.exe autocheck autochk *" [file not found], [file not found], [MS], [file not found]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Filzip\(Default) = "{B28C18DB-6816-4F31-9630-397683E3C2C3}"
-> {HKLM...CLSID} = "Filzip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Filzip\fzshext.dll" [empty string]
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\Programme\IZArc\IZArcCM.dll" [null data]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\shellex.dll" ["Kaspersky Lab"]
MaxSplitter\(Default) = "{F169D961-B907-11D0-B8FA-A85800C10000}"
-> {HKLM...CLSID} = "MaxSplitter"
\InProcServer32\(Default) = "C:\Programme\MaxSplitter\MSplitShellExt.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
IZArcCM\(Default) = "{8D9D4D0D-FDDD-44CB-AAB2-6161FA0757C5}"
-> {HKLM...CLSID} = "IZArc Shell Context Menu"
\InProcServer32\(Default) = "C:\Programme\IZArc\IZArcCM.dll" [null data]
LockFolder\(Default) = "{4852341A-43E6-4994-B29B-E82904992884}"
-> {HKLM...CLSID} = "LckFldMenu.Locker"
\InProcServer32\(Default) = "C:\Programme\FolderAccess\LckFldMenu.dll" ["Topdownloads Network"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
a2FreeContMenu\(Default) = "{A155339D-CCCD-4714-85EB-3754B804C9DF}"
-> {HKLM...CLSID} = "a-squared Free Context Menu"
\InProcServer32\(Default) = "C:\PROGRA~1\A-SQUA~1\A2FREE~1.DLL" ["Emsi Software GmbH"]
Filzip\(Default) = "{B28C18DB-6816-4F31-9630-397683E3C2C3}"
-> {HKLM...CLSID} = "Filzip Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Filzip\fzshext.dll" [empty string]
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\shellex.dll" ["Kaspersky Lab"]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState


Startup items in "**" & "All Users" startup folders:
----------------------------------------------------

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Kaspersky Anti-Hacker" -> shortcut to: "C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Hacker\KAVPF.exe /silence" ["Kaspersky Lab"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "0"
-> {HKLM...CLSID} = "MSN Toolbar"
\InProcServer32\(Default) = "C:\Programme\MSN Toolbar\01.01.1601.0\de\msntb.dll" [MS]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)
-> {HKLM...CLSID} = "EPSON Web-To-Page"
\InProcServer32\(Default) = "C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll" ["SEIKO EPSON CORPORATION"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_06"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_06\bin\npjpi150_06.dll" ["Sun Microsystems, Inc."]


All Non-Disabled Services (Display Name, Service Name, Path {Service DLL}):
---------------------------------------------------------------------------

Dienst für Seriennummern der tragbaren Medien, WmdmPmSN, "C:\WINDOWS\System32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\mspmsnsv.dll" [MS]}
Epson Printer Status Agent4, StatusAgent4, "C:\WINDOWS\System32\SAgent4.exe" ["SEIKO EPSON CORPORATION"]
EPSON V3 Service2(03), EPSON_PM_RPCV2_01, "C:\WINDOWS\System32\E_S00RP1.EXE" ["SEIKO EPSON CORPORATION"]
InstallDriver Table Manager, IDriverT, "C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe" ["Macrovision Corporation"]
kavsvc, kavsvc, ""C:\Programme\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Virus Personal\kavsvc.exe"" ["Kaspersky Lab"]
LckFldService, LckFldService, "C:\WINDOWS\System32\LckFldService.exe" [null data]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\System32\nvsvc32.exe" ["NVIDIA Corporation"]
PDEngine, PDEngine, "C:\Programme\Raxco\PerfectDisk\PDEngine.exe" ["Raxco Software, Inc."]
PDScheduler, PDSched, "C:\Programme\Raxco\PerfectDisk\PDSched.exe" ["Raxco Software, Inc."]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
Verwaltungsdienst für die Verwaltung logischer Datenträger, dmadmin, "C:\WINDOWS\System32\dmadmin.exe /com" ["Microsoft Corp., Veritas Software"]
WMI-Leistungsadapter, WmiApSrv, "C:\WINDOWS\System32\wbem\wmiapsrv.exe" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 218 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 171 seconds.
---------- (total run time: 1432 seconds)




Noch was zu "BootExecute", seit dem Stromausfall meckert Spybot-Resident wegen Reg-Einträgen.




Grüße
chu-chok





Hier noch einige Nachtraege:


** - 06-09-14 13:35:26,85 Service Pack 1
ComboFix 06.09.14 - Running from: C:\Dokumente und Einstellungen\**\Desktop\Security

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\taskmgr.com


((((((((((((((((((((((((((((((( Files Created from 2006-08-14 to 2006-09-14 ))))))))))))))))))))))))))))))))))


No new files created in this timespan


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-14 13:23 -------- d-------- C:\Programme\Mozilla Firefox
2006-09-14 13:22 -------- d-------- C:\Programme\Trojancheck 6
2006-09-14 13:11 -------- d-------- C:\Programme\CleanUp!
2006-09-13 19:15 -------- d-------- C:\Dokumente und Einstellungen\**\Anwendungsdaten\SpamTest
2006-09-13 19:08 -------- d-------- C:\Programme\Kaspersky Lab
2006-09-13 19:08 -------- d-------- C:\Programme\Gemeinsame Dateien\Kaspersky Lab
2006-09-13 19:08 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-09-13 00:20 -------- d-------- C:\Programme\a-squared Free
2006-08-30 22:10 -------- d-------- C:\Dokumente und Einstellungen\**\Anwendungsdaten\Skype
2006-08-14 10:30 -------- d-------- C:\Programme\PhototoVCD
2006-08-07 14:36 -------- d-------- C:\Programme\Filzip
2006-07-30 21:05 -------- d-------- C:\Programme\a2 free
2006-07-23 20:27 -------- d-------- C:\Programme\No23 Recorder
2006-07-09 13:42 42920 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"EPSON Stylus DX4200 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEE.EXE /P26 \"EPSON Stylus DX4200 Series\" /M \"Stylus DX4200\" /EF \"HKCU\""
"SpybotSD TeaTimer"="C:\\Programme\\Spybot - Search & Destroy\\TeaTimer.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Trojancheck 6 Guard"="C:\\Programme\\Trojancheck 6\\tcguard.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"EPSON Stylus DX4200 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_FATIAEE.EXE /P26 \"EPSON Stylus DX4200 Series\" /O6 \"USB001\" /M \"Stylus DX4200\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"Zone Labs Client"="\"C:\\Programme\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"KAVPersonal50"="\"C:\\Programme\\Kaspersky Lab\\Kaspersky Security Suite\\Kaspersky Anti-Virus Personal\\kav.exe\" /minimize"
"OESpamTest"="C:\\PROGRA~1\\KASPER~1\\KASPER~1\\KASPER~3\\OESpamTest.ExE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,00,02,00,00,00,00,00,00,00,02,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,00,02,00,00,00,00,00,00,00,02,00,00,e2,02,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"NoDispCPL"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoVisualStyleChoice"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoViewContextMenu"=dword:00000000
"NoWinKeys"=dword:00000000
"NoShellSearchButton"=dword:00000000
"NoFileAssociate"=dword:00000000
"NoFileMenu"=dword:00000000
"NoFolderOptions"=dword:00000000
"NoFind"=dword:00000000
"NoRun"=dword:00000000
"NoClose"=dword:00000000
"NoCommonGroups"=dword:00000000
"StartMenuLogoff"=dword:00000000
"NoSMHelp"=dword:00000000
"NoControlPanel"=dword:00000000
"NoTrayContextMenu"=dword:00000000
"NoToolbarsOnTaskbar"=dword:00000000
"NoLowDiskSpaceChecks"=dword:00000001
"NoSimpleStartMenu"=dword:00000000
"HideClock"=dword:00000000
"NoTrayItemsDisplay"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000091
"NoInstrumentation"=dword:00000001
"NoCDBurning"=dword:00000000
"NoRecentDocsHistory"=dword:00000000
"ClearRecentDocsOnExit"=dword:00000001
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000
"ForceActiveDesktopOn"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000001
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"DisableTaskMgr"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoResolveTrack"=dword:00000000
"NoCDBurning"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000000
"NoActiveDesktopChanges"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"SystemManager"="C:\\WINDOWS\\System32\\msacm32.exe"

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: 14.09.2006 13:36:33.14
ComboFix.txt








Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: C48C-1044

Verzeichnis von C:\

14.09.2006 13:48 0 sys.txt
14.09.2006 13:47 7.223 system.txt
14.09.2006 13:46 287 systemtemp.txt
14.09.2006 13:43 110.467 system32.txt
14.09.2006 13:36 7.953 ComboFix.txt
14.09.2006 11:32 402.653.184 pagefile.sys
13.09.2006 22:24 3.071 eScan_neu.txt
13.09.2006 14:04 0 23990098.$$$
13.09.2006 14:04 6 AVPCallback.log
13.09.2006 12:25 3.905 smitfiles.txt
10.07.2006 16:45 564.992 No23_Record_10.07.2006_15.18.59_.mp3
08.06.2006 23:42 194 boot.ini



Verzeichnis von C:\WINDOWS\system32

14.09.2006 13:22 50.257 nvapps.xml
14.09.2006 11:34 54.112 vsconfig.xml
14.09.2006 11:32 17.810 lckfldservicelog.txt
20.08.2006 09:42 41 Filzip.ini
09.08.2006 23:19 4.212 zllictbl.dat
09.07.2006 13:42 42.920 vsutil_loc0407.dll
09.07.2006 13:42 392.824 vsdatant.sys
09.07.2006 13:42 71.672 zlcommdb.dll
09.07.2006 13:42 83.960 zlcomm.dll
09.07.2006 13:42 100.344 vsxml.dll
09.07.2006 13:42 59.384 vswmi.dll
09.07.2006 13:42 440.312 vsutil.dll
09.07.2006 13:42 71.672 vsregexp.dll
09.07.2006 13:42 104.440 vsmonapi.dll
09.07.2006 13:42 157.688 vsinit.dll
09.07.2006 13:42 268.280 vspubapi.dll
09.07.2006 13:42 83.960 vsdata.dll
09.07.2006 13:41 796.584 libeay32_0.9.6l.dll
30.06.2006 17:02 311.604 perfh009.dat
30.06.2006 17:02 39.992 perfc009.dat
30.06.2006 17:02 48.156 perfc007.dat
30.06.2006 17:02 316.594 perfh007.dat
30.06.2006 17:02 723.744 PerfStringBackup.INI




Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: C48C-1044

Verzeichnis von C:\WINDOWS

14.09.2006 13:43 41 Filzip.ini
14.09.2006 11:33 0 0.log
14.09.2006 11:33 159 wiadebug.log
14.09.2006 11:33 0 wiaservc.log
14.09.2006 11:32 2.048 bootstat.dat
14.09.2006 00:58 339.046 ntbtlog.txt
13.09.2006 12:27 255 setupact.log
12.09.2006 14:23 5.301 setupapi.log
24.08.2006 23:54 49 StreamRipper32.INI
24.08.2006 23:54 418 sripper.ini
14.08.2006 10:38 1.409 QTFont.for
14.08.2006 10:38 54.156 QTFont.qfn
10.07.2006 17:12 1.064 wmsetup.log
08.06.2006 23:42 574 win.ini
08.06.2006 23:42 257 system.ini




Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: C48C-1044

Verzeichnis von C:\DOKUME~1\**\LOKALE~1\Temp

14.09.2006 13:22 0 BCG30.tmp
1 Datei(en) 0 Bytes
0 Verzeichnis(se), 1.756.643.328 Bytes frei









10)DPF????
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: C48C-1044

Verzeichnis von C:\WINDOWS\Downloaded Program Files

07.10.2004 23:16 815 bitdefender.inf
08.10.2004 00:05 327.680 bitdefender.ocx
25.07.2002 17:13 24.576 dwusplay.dll
25.07.2002 17:13 196.608 dwusplay.exe
12.07.2000 04:02 36.864 fxfileop.dll
25.07.2002 17:05 172.032 isusweb.dll
01.05.2003 08:09 772 jinstall-1_4_1_03.inf
20.06.2003 07:12 728 jinstall-1_4_2.inf
20.01.2000 15:25 1.162 Microsoft XML Parser for Java.osd
27.08.2005 14:30 5.065 swflash.inf
31.10.2001 12:37 118 uninst.bat
03.08.2004 14:51 293 wuweb.inf
12 Datei(en) 766.713 Bytes

Anzahl der angezeigten Dateien:
12 Datei(en) 766.713 Bytes
0 Verzeichnis(se), 1.754.914.816 Bytes frei




Dieses Bild ist uebrigens nie aufgetaucht:

#2 virustotal
Oben auf der Seite --> auf Durchsuchen klicken --> Datei mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten
http://www.virustotal.com/flash/index_en.html

C:\WINDOWS\System32\msacm32.exe

poste den report
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hallo Sabina,

bitte entschuldige meine Nachfrage, aber ich finde diese exe nicht.

Da ist nur die msacm32.dll und eine msacm32.drv sowie eine msacm.dll.

Die ersten habe ich mal an virustotal gesendet.


msacm32.dll


Complete scanning result of "msacm32.dll", received in VirusTotal at 09.14.2006, 18:40:45 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.14.2006 no virus found
Authentium 4.93.8 09.14.2006 no virus found
Avast 4.7.844.0 09.13.2006 no virus found
AVG 386 09.14.2006 no virus found
BitDefender 7.2 09.14.2006 no virus found
CAT-QuickHeal 8.00 09.14.2006 no virus found
ClamAV devel-20060426 09.14.2006 no virus found
DrWeb 4.33 09.14.2006 no virus found
eTrust-InoculateIT 23.72.124 09.14.2006 no virus found
eTrust-Vet 30.3.3077 09.14.2006 no virus found
Ewido 4.0 09.14.2006 no virus found
Fortinet 2.82.0.0 09.13.2006 no virus found
F-Prot 3.16f 09.14.2006 no virus found
F-Prot4 4.2.1.29 09.14.2006 no virus found
Ikarus 0.2.65.0 09.14.2006 no virus found
Kaspersky 4.0.2.24 09.14.2006 no virus found
McAfee 4851 09.13.2006 no virus found
Microsoft 1.1560 09.14.2006 no virus found
NOD32v2 1.1756 09.14.2006 no virus found
Norman 5.90.23 09.14.2006 no virus found
Panda 9.0.0.4 09.14.2006 no virus found
Sophos 4.09.0 09.14.2006 no virus found
Symantec 8.0 09.14.2006 no virus found
TheHacker 5.9.8.211 09.14.2006 no virus found
UNA 1.83 09.14.2006 no virus found
VBA32 3.11.1 09.13.2006 no virus found
VirusBuster 4.3.7:9 09.14.2006 no virus found

Aditional Information
File size: 67584 bytes
MD5: 18717704cc9d9165431e12ab416194b0
SHA1: ae29248eefae95e270a78249b6fef8cf15b65918


msacm32.drv


Complete scanning result of "msacm32.drv", received in VirusTotal at 09.14.2006, 18:43:04 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.14.2006 no virus found
Authentium 4.93.8 09.14.2006 no virus found
Avast 4.7.844.0 09.13.2006 no virus found
AVG 386 09.14.2006 no virus found
BitDefender 7.2 09.14.2006 no virus found
CAT-QuickHeal 8.00 09.14.2006 no virus found
ClamAV devel-20060426 09.14.2006 no virus found
eTrust-InoculateIT 23.72.124 09.14.2006 no virus found
eTrust-Vet 30.3.3077 09.14.2006 no virus found
DrWeb 4.33 09.14.2006 no virus found
Ewido 4.0 09.14.2006 no virus found
Fortinet 2.82.0.0 09.13.2006 no virus found
F-Prot 3.16f 09.14.2006 no virus found
F-Prot4 4.2.1.29 09.14.2006 no virus found
Ikarus 0.2.65.0 09.14.2006 no virus found
Kaspersky 4.0.2.24 09.14.2006 no virus found
McAfee 4851 09.13.2006 no virus found
Microsoft 1.1560 09.14.2006 no virus found
NOD32v2 1.1756 09.14.2006 no virus found
Norman 5.80.02 09.14.2006 no virus found
Panda 9.0.0.4 09.14.2006 no virus found
Sophos 4.09.0 09.14.2006 no virus found
Symantec 8.0 09.14.2006 no virus found
TheHacker 5.9.8.211 09.14.2006 no virus found
UNA 1.83 09.14.2006 no virus found
VBA32 3.11.1 09.13.2006 no virus found
VirusBuster 4.3.7:9 09.14.2006 no virus found

Aditional Information
File size: 20992 bytes
MD5: 84bdd3c4fadb534bd843d949cfcde53c
SHA1: 910b83aa4facf51b7d6dae1f5ceef35b1e2adbd5



Was ich nicht verstehe, ist, dass e-scan eine Warnung ausgibt, KAV Personal 5.0.385 aber nichts findet.
(Ich habe heute nochmals beide Programme nach einem Update laufen lassen - gleiches Ergebnis.)

#4 die exe war drauf, aber wahrscheinlich nur noch in der registry vorhanden..........
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"SystemManager"="C:\\WINDOWS\\System32\\msacm32.exe"

----------------------

Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als sheriff.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden.
Die Datei "sheriff.reg" auf dem Desktop doppelklicken.

Zitat

REGEDIT4

[-HKEY_CURRENT_USER\Software\SpySheriff]

[-HKEY_CURRENT_USER\Software\SNO2]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpySheriff]

[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoViewContextMenu"=-
"NoWinKeys"=-
"NoShellSearchButton"=-
"NoFileAssociate"=-
"NoFileMenu"=-
"NoFolderOptions"=-
"NoFind"=-
"NoRun"=-
"NoClose"=-
"NoCommonGroups"=-
"NoSMHelp"=-
"NoControlPanel"=-
"NoTrayContextMenu"=-
"NoToolbarsOnTaskbar"=-
"NoTrayItemsDisplay"=-
"NoActiveDesktop"=-
"NoSaveSettings"=-
"ClassicShell"=-
"NoThemesTab"=-
"ForceActiveDesktopOn"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoResolveTrack"=-
"NoActiveDesktopChanges"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]
"SystemManager"=-

**
suche eine DartSock.dll -- findest du sie ?


Start > Ausfuehren --> reinschreiben --> cmd.exe
und ok. kopiere rein und poste alles, was im Texteditor erscheint

dir /s /a "c:\DartSock*.*" > c:\find.txt & start notepad c:\find.txt
__________
MfG Sabina

rund um die PC-Sicherheit

#5 "sheriff.reg" habe ich gemacht.

DartSock.dll habe ich in System32 auch gefunden.

Hier der Text von find.txt:

Zitat

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: C48C-1044

Verzeichnis von c:\WINDOWS\system32

21.12.2001 14:35 212.992 DARTSOCK.DLL
1 Datei(en) 212.992 Bytes

Anzahl der angezeigten Dateien:
1 Datei(en) 212.992 Bytes
0 Verzeichnis(se), 2.400.501.760 Bytes frei

Kommt es denn oeffter vor, dass e-scan und Kaspersky unterschiedliche Ergebnisse anzeigen?
Ist das nicht der selbe Scanner?
Kaspersky habe ich ja nur installiert, weil ich e-scan ueberpruefen wollte - AntiVir ... hatten ja nichts gefunden.
Das KAV aber auch nichts findet macht mich stutzig.

Gruesse
chu-hok

#6 virustotal
Oben auf der Seite --> auf Durchsuchen klicken --> Datei mit korrektem Pfad einkopieren) --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten
http://www.virustotal.com/flash/index_en.html

c:\WINDOWS\system32\DARTSOCK.DLL

poste den report
__________
MfG Sabina

rund um die PC-Sicherheit

#7

Zitat

Complete scanning result of "DARTSOCK.DLL", received in VirusTotal at 09.14.2006, 23:46:44 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.14.2006 no virus found
Authentium 4.93.8 09.14.2006 no virus found
Avast 4.7.844.0 09.13.2006 no virus found
AVG 386 09.14.2006 no virus found
BitDefender 7.2 09.14.2006 no virus found
CAT-QuickHeal 8.00 09.14.2006 no virus found
ClamAV devel-20060426 09.14.2006 no virus found
DrWeb 4.33 09.14.2006 no virus found
eTrust-InoculateIT 23.72.124 09.14.2006 no virus found
eTrust-Vet 30.3.3077 09.14.2006 no virus found
Ewido 4.0 09.14.2006 no virus found
Fortinet 2.82.0.0 09.13.2006 no virus found
F-Prot 3.16f 09.14.2006 no virus found
F-Prot4 4.2.1.29 09.14.2006 no virus found
Ikarus 0.2.65.0 09.14.2006 no virus found
Kaspersky 4.0.2.24 09.14.2006 no virus found
McAfee 4852 09.14.2006 no virus found
Microsoft 1.1560 09.14.2006 no virus found
NOD32v2 1.1756 09.14.2006 no virus found
Norman 5.90.23 09.14.2006 no virus found
Panda 9.0.0.4 09.14.2006 no virus found
Sophos 4.09.0 09.14.2006 no virus found
Symantec 8.0 09.14.2006 no virus found
TheHacker 5.9.8.211 09.14.2006 no virus found
UNA 1.83 09.14.2006 no virus found
VBA32 3.11.1 09.14.2006 no virus found
VirusBuster 4.3.7:9 09.14.2006 no virus found

Aditional Information
File size: 212992 bytes
MD5: abacc807e439bdee6d871040707f77ff
SHA1: 226b1faf009449e35172cecdf4c93498faf5261c

Schon mal Danke fuer Deine Bemuehungen.

#8 ist wohl ein Bug von escan.

escan ist bekannt dafuer, mehr anzuzeigen als notwendig...damit man das tool laedt + kauft
__________
MfG Sabina

rund um die PC-Sicherheit

#9

Zitat

Sabina postete
ist wohl ein Bug von escan.

escan ist bekannt dafuer, mehr anzuzeigen als notwendig...damit man das tool laedt + kauft

Mich haben sie drangekriegt.

Gekauft hab' ich's dennoch nicht, dafuer jetzt "Kaspersky Personal Security Suite" installiert.

AntiVir fand ich aber einfacher zu bedienen - schauen wir mal.

Ich frage mich nur, was ich jetzt mit ZoneAlarm mache.
Zur Zeit laeuft die noch gleichzeitig mit Kaspersky Anti-Hacker.


Besten Dank und eine ruhige Nachtschicht wuenscht Dir
chu-chok

P.S.: "BootExecute" ist vernachlaessigbar?

#10

Zitat

HKLM\System\CurrentControlSet\Control\Session Manager\"BootExecute

BootExecute
http://www.winfaq.de/faq_html/tip0048.htm

da musst du mal googeln,die BootExecute fehlt, ich habe im Moment keine Zeit, um zu suchen, wie man das wieder aktivieren kann....
__________
MfG Sabina

rund um die PC-Sicherheit