Home » Spyware & Browser Hijacker Support Forum » "Critical System Error!" Gelbes Fragezeichen muss weg » Themenansicht
"Critical System Error!" Gelbes Fragezeichen muss wegThema ist geschlossen! |
||
|---|---|---|
Thema ist geschlossen! |
||
| #0
| ||
|
01.11.2006, 23:26
Member
Beiträge: 14 |
||
 
|
|
|
|
02.11.2006, 12:17
Ehrenmitglied
 Beiträge: 29434 |
#2
Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren) iVideoCodec in edit und klicke "Ok". Notepad wird sich oeffnen - hier posten, bitte ______ auf dem Rechner ist auch der Swizzor-Trojaner - fuer leute, die es sich nicht verkneifen koennen, den NetPumper + MessengerPlus! 3 zu laden...  , deshalb poste noch folgendes Log:Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere den Text, der erscheint Zitat cd\ __________ MfG Sabina rund um die PC-Sicherheit Dieser Beitrag wurde am 02.11.2006 um 12:23 Uhr von Sabina editiert.
|
|
|
|
|
|
|
02.11.2006, 16:10
Member
Themenstarter Beiträge: 14 |
#3
Gottseidank hatte ich Firefox mit der Seite noch offen weil nachdem ich RegSearch gezogen habe geht nichts mehr. Also Programme lassen sich nichtmehr starten.. Task Manager u. Editor zb net >.< Naja seit gestern Abend ist das auchso gewesen nachdem der PC etwas (paar Minuten) länger an ist.. habe gehört man kann Trojaner entfernen aber nicht das was sie angerichtet haben? Hab für Windows eine eigene Partition gemacht, ist es da sinnvoller einfach C:\ zu formatieren?
Und danke für die mühe die du dir machst x) |
|
|
|
|
|
|
02.11.2006, 16:29
Ehrenmitglied
Beiträge: 29434 |
#4
nein, nicht formatieren, dass bekommen wir gebacken
 - starte den rechner neuRegistry Search Tool http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip eventuelle Meldung vom Virenscanner --- > warnmeldung:bösartiges skript entdeckt --> ignorieren Doppelklick:regsrch.vbs reinkopieren: iVideoCodec Press 'OK' warten, bis die Suche beendet ist. (Ergebnis bitte posten) + die listen.bat (siehe oben) abarbeiten ________ wenn es nicht geht, dann reinigen wir so, ich habe schon fast alle infos beisammen - ich erstelle dann ein script mit dem avenger__________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
02.11.2006, 16:46
Member
Themenstarter Beiträge: 14 |
#5
Zitat Sabina posteteNicht ganz es kommt son Windows Script Host und das Skripte für diesen Computer deaktiviert sind ^^ Hab jetzt mit RegSearch gemacht wie am anfang gesagt REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 02.11.2006 16:40:05 for strings: ; 'ivideocodec' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}\InprocServer32] @="C:\\Programme\\iVideoCodec\\isaddon.dll" [HKEY_USERS\S-1-5-21-448539723-602609370-725345543-1003\Software\Internet Security] "Path"="C:\\Programme\\iVideoCodec" [HKEY_USERS\S-1-5-21-448539723-602609370-725345543-1003\Software\Microsoft\Windows\ShellNoRoam\MUICache] "C:\\Dokumente und Einstellungen\\Jan\\Desktop\\ivideocodec.1135.exe"="ivideocodec.1135" ; End Of The Log... Welchen Log in eine .bat ? Dein Zitat da?  Sry aber in dem Bereich kenn ich mich nicht aus =(Btw ist wieder soweit das ich das alles nicht öffnen kann.. Und Neustarten geht auchnur am PC selber ^^ |
|
|
|
|
|
|
02.11.2006, 16:58
Ehrenmitglied
Beiträge: 29434 |
#6
Avenger
http://virus-protect.org/artikel/tools/avenger.html kopiere rein Zitat Registry values to delete:Klicke die grüne Ampel das Script wird nun ausgeführt, dann wird der PC automatisch neustarten »» loesche das Backup vom Avenger unter C:\Avenger\backup.zip + leere den Papierkorb «« scanne mit smitfraudfix - Option 1 und 2 ( lasse auch die Registry mitreinigen) http://virus-protect.org/artikel/tools/smitfrautfix.html __________ MfG Sabina rund um die PC-Sicherheit Dieser Beitrag wurde am 03.11.2006 um 00:38 Uhr von Sabina editiert.
|
|
|
|
|
|
|
02.11.2006, 17:08
Member
Themenstarter Beiträge: 14 |
#7
aaaah meine leiste is unten weg und ca 50 IE fenster sind offen aaaaah, wollten auchwas runterladen ^^
*Neustart* -.- Habe dein Text da in ein Textdokument kopiert und das in Avenger gestartet.. dann kam ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Fatal error: could not create new script file. Error code: 1813 Error logged to errorlog.txt. Aborting now! Dieser Beitrag wurde am 02.11.2006 um 17:17 Uhr von henne90 editiert.
|
|
|
|
|
|
|
02.11.2006, 18:18
Ehrenmitglied
Beiträge: 29434 |
||
|
|
|
|
|
02.11.2006, 18:31
Member
Themenstarter Beiträge: 14 |
#9
Hat sich erledigt ^^
Das zweite mal gings, lag wohl daran das das Txt dokument Neues Textdokument hieß und nicht Script.. naja is weg.. Hm hier Combofix2 ka ob das der richtige log is sollte aber weil neueres gibs net..^^ Jan - 06-11-01 23:37:46,57 Service Pack 2 ComboFix 06.10.19 - Running from: "C:\Dokumente und Einstellungen\Jan\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-10-01 to 2006-11-01 )))))))))))))))))))))))))))))))))) 2006-11-01 23:07 53,248 --a------ C:\WINDOWS\system32\Process.exe 2006-11-01 23:07 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2006-11-01 23:07 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2006-11-01 23:07 135,168 --a------ C:\WINDOWS\system32\swreg.exe 2006-11-01 19:55 106,496 --a------ C:\WINDOWS\system32\rrtcany.dll 2006-10-28 21:06 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys 2006-10-28 21:06 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll 2006-10-28 21:05 61,440 --a------ C:\WINDOWS\system32\csnpstd2.dll 2006-10-28 21:05 57,344 --a------ C:\WINDOWS\system32\rsnpstd2.dll 2006-10-28 21:05 53,248 --a------ C:\WINDOWS\system32\dsnpstd2.dll 2006-10-28 21:05 53,248 --a------ C:\WINDOWS\amcap.exe 2006-10-28 21:05 36,864 --a------ C:\WINDOWS\system32\vsnpstd2.dll 2006-10-28 21:05 347,264 --a------ C:\WINDOWS\system32\drivers\snpstd2.sys 2006-10-28 21:05 286,720 --a------ C:\WINDOWS\vsnpstd2.exe 2006-10-28 21:05 20,480 --a------ C:\WINDOWS\usnpstd2.exe 2006-10-26 21:52 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe 2006-10-26 19:39 69,504 --a------ C:\WINDOWS\system32\drivers\LMOUKE.sys 2006-10-26 19:39 53,632 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS 2006-10-26 19:39 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS 2006-10-26 19:39 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe 2006-10-26 19:38 89,088 --a------ C:\WINDOWS\system32\atl71.dll 2006-10-26 19:38 21,504 --a------ C:\WINDOWS\system32\hidserv.dll 2006-10-26 19:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2006-10-26 19:38 14,592 --a------ C:\WINDOWS\system32\drivers\LUsbKbd.sys 2006-10-26 19:38 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll 2006-10-26 19:37 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2006-10-22 01:43 2,321,408 --a------ C:\WINDOWS\system32\TUKernel.exe 2006-10-22 01:37 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll 2006-10-22 01:20 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-11-01 22:41 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\trans locks 2006-11-01 22:27 -------- d--h----- C:\Programme\InstallShield Installation Information 2006-11-01 22:27 -------- d-------- C:\Programme\MUSICMATCH 2006-11-01 20:43 -------- d-------- C:\Programme\Gemeinsame Dateien 2006-11-01 20:43 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\ScanSoft 2006-11-01 20:36 -------- d-------- C:\Programme\iVideoCodec 2006-11-01 19:50 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\.bittorrent 2006-11-01 19:41 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\OpenOffice.org2 2006-10-28 21:05 -------- d-------- C:\Programme\Trust 2006-10-28 07:15 130048 --a------ C:\WINDOWS\system32\SpoonUninstall.exe 2006-10-27 19:27 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2006-10-27 19:19 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\InstallShield 2006-10-26 19:43 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Logitech 2006-10-26 19:38 -------- d-------- C:\Programme\Gemeinsame Dateien\Logitech 2006-10-22 01:46 -------- d-------- C:\Programme\WinRAR 2006-10-22 01:36 -------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard 2006-10-22 01:20 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2006-10-19 00:27 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\teamspeak2 2006-10-08 17:25 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Creative 2006-10-07 12:05 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\AdobeUM 2006-10-03 17:14 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla 2006-10-03 17:13 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Thunderbird 2006-09-27 22:49 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Skype 2006-09-22 23:16 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\IsoTeamGreat 2006-09-18 17:46 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\NetPumper 2006-09-18 16:56 -------- d-------- C:\Programme\trans locks 2006-09-17 16:43 -------- d-------- C:\Programme\Gemeinsame Dateien\Nullsoft 2006-09-15 14:47 -------- d-------- C:\Programme\AviSynth 2.5 2006-09-13 06:02 1084416 --a------ C:\WINDOWS\system32\msxml3.dll 2006-09-07 20:34 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Help 2006-09-06 17:35 -------- dr------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Brother 2006-09-06 17:14 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Xerox 2006-09-06 17:13 -------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield 2006-09-06 17:13 -------- d-------- C:\Programme\Common Files 2006-09-06 17:13 -------- d-------- C:\Programme\Brother 2006-09-06 17:10 -------- d-------- C:\Programme\ScanSoft 2006-09-05 17:38 737280 --a------ C:\WINDOWS\iun6002.exe 2006-09-03 20:48 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Real 2006-09-02 17:42 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Shareaza 2006-09-01 19:40 -------- d---s---- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Microsoft 2006-08-25 16:46 617472 --a------ C:\WINDOWS\system32\comctl32.dll 2006-08-23 23:38 42920 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll 2006-08-21 13:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe 2006-08-16 12:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "LDM"="E:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "MSMSGS"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background" "TuneUp MemOptimizer"="\"E:\\Programme\\TuneUp Utilities 2006\\MemOptimizer.exe\" autostart" "one browse"="C:\\DOKUME~1\\Jan\\ANWEND~1\\TRANSL~1\\Shimabout.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe" "avgnt"="\"E:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" "CTSysVol"="E:\\Programme\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe" "CTHelper"="CTHELPER.EXE" "AsioReg"="REGSVR32.EXE /S CTASIO.DLL" "UpdReg"="C:\\WINDOWS\\UpdReg.EXE" "Gainward"="C:\\WINDOWS\\TBPanel.exe /A" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\ 65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00 "Zone Labs Client"="\"E:\\Programme\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime" "MessengerPlus3"="\"E:\\Programme\\MessengerPlus! 3\\MsgPlus.exe\"" "SNPSTD2"="C:\\WINDOWS\\vsnpstd2.exe" "MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto" "kinddartuperror"="C:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\jugscashkinddart\\browsestart.exe" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Die derzeitige Homepage" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e0,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "isamonitor.exe"="C:\\Programme\\PornPass Manager\\isamonitor.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}" "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "ferrateen"="{27321538-5739-4aa1-b84c-7d18e4383f1f}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Sinus 154 stick.lnk] "path"="C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\Sinus 154 stick.lnk" "backup"="C:\\WINDOWS\\pss\\Sinus 154 stick.lnkCommon Startup" "location"="Common Startup" "command"="E:\\PROGRA~1\\DT\\SINUS1~1\\Wifiusb.exe " "item"="Sinus 154 stick" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^BitTorrent.lnk] "path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\BitTorrent.lnk" "backup"="C:\\WINDOWS\\pss\\BitTorrent.lnkStartup" "location"="Startup" "command"="E:\\PROGRA~1\\BITTOR~2\\BITTOR~1.EXE " "item"="BitTorrent" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^OpenOffice.org 2.0.lnk] "path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\OpenOffice.org 2.0.lnk" "backup"="C:\\WINDOWS\\pss\\OpenOffice.org 2.0.lnkStartup" "location"="Startup" "command"="C:\\PROGRA~1\\OPENOF~1.0\\program\\QUICKS~1.EXE " "item"="OpenOffice.org 2.0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^Trillian.lnk] "path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\Trillian.lnk" "backup"="C:\\WINDOWS\\pss\\Trillian.lnkStartup" "location"="Startup" "command"="E:\\Programme\\Trillian\\trillian.exe " "item"="Trillian" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^Yahoo! Widget Engine.lnk] "path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\Yahoo! Widget Engine.lnk" "backup"="C:\\WINDOWS\\pss\\Yahoo! Widget Engine.lnkStartup" "location"="Startup" "command"="E:\\Programme\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe " "item"="Yahoo! Widget Engine" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="ICQLite" "hkey"="HKLM" "command"="\"E:\\Programme\\ICQLite\\ICQLite.exe\" -minimize" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="iTunesHelper" "hkey"="HKLM" "command"="\"E:\\Programme\\iTunes\\iTunesHelper.exe\"" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msmsgs" "hkey"="HKCU" "command"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="msnmsgr" "hkey"="HKCU" "command"="\"C:\\Programme\\MSN Messenger\\msnmsgr.exe\" /background" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="mwsoemon" "hkey"="HKCU" "command"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="NeroCheck" "hkey"="HKLM" "command"="C:\\WINDOWS\\system32\\NeroCheck.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="nwiz" "hkey"="HKLM" "command"="nwiz.exe /install" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\one browse] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Shimabout" "hkey"="HKCU" "command"="C:\\DOKUME~1\\Jan\\ANWEND~1\\TRANSL~1\\Shimabout.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSPVideo9] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="pspVideo9" "hkey"="HKLM" "command"="E:\\Programme\\pspvideo9\\pspVideo9.exe -t" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="qttask" "hkey"="HKLM" "command"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="PDVDServ" "hkey"="HKLM" "command"="E:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SB Audigy 2 Startup Menu] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"=" /L:GER" "hkey"="HKCU" "command"=" /L:GER" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Skype" "hkey"="HKCU" "command"="\"E:\\Programme\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="Steam" "hkey"="HKCU" "command"="D:\\Valve\\Steam\\\\Steam.exe -silent" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="SweetIM" "hkey"="HKLM" "command"="C:\\Programme\\Macrogaming\\SweetIM\\SweetIM.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="winampa" "hkey"="HKLM" "command"="E:\\Programme\\Winamp\\winampa.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="YahooMessenger" "hkey"="HKCU" "command"="\"C:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\1-Klick-Wartung.job C:\WINDOWS\tasks\A895B3D891EE26F8.job Completion time: 06-11-01 23:38:27.48 C:\ComboFix.txt ... 06-11-01 23:38 |
|
|
|
|
|
|
03.11.2006, 00:35
Ehrenmitglied
Beiträge: 29434 |
#10
kopiere nur in den avenger (ich habe das script veraendert)
Zitat Registry values to delete:poste den report __________ MfG Sabina rund um die PC-Sicherheit Dieser Beitrag wurde am 03.11.2006 um 00:39 Uhr von Sabina editiert.
|
|
|
|
|
|
|
03.11.2006, 15:23
Member
Themenstarter Beiträge: 14 |
#11
Logfile of The Avenger version 1, by Swandog46
Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\daqaongn ******************* Script file located at: \??\C:\WINDOWS\yqagflgj.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\rrtcany.dll not found! Deletion of file C:\WINDOWS\system32\rrtcany.dll failed! Could not process line: C:\WINDOWS\system32\rrtcany.dll Status: 0xc0000034 File C:\WINDOWS\tasks\A895B3D891EE26F8.job not found! Deletion of file C:\WINDOWS\tasks\A895B3D891EE26F8.job failed! Could not process line: C:\WINDOWS\tasks\A895B3D891EE26F8.job Status: 0xc0000034 File C:\Dokumente und Einstellungen\Jan\Desktop\ivideocodec.1135.exe not found! Deletion of file C:\Dokumente und Einstellungen\Jan\Desktop\ivideocodec.1135.exe failed! Could not process line: C:\Dokumente und Einstellungen\Jan\Desktop\ivideocodec.1135.exe Status: 0xc0000034 Folder C:\Programme\NetPumper not found! Deletion of folder C:\Programme\NetPumper failed! Could not process line: C:\Programme\NetPumper Status: 0xc0000034 Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jugscashkinddart not found! Deletion of folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jugscashkinddart failed! Could not process line: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jugscashkinddart Status: 0xc0000034 Folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\trans locks not found! Deletion of folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\trans locks failed! Could not process line: C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\trans locks Status: 0xc0000034 Folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\IsoTeamGreat not found! Deletion of folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\IsoTeamGreat failed! Could not process line: C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\IsoTeamGreat Status: 0xc0000034 Folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\NetPumper not found! Deletion of folder C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\NetPumper failed! Could not process line: C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\NetPumper Status: 0xc0000034 Folder C:\Programme\trans locks not found! Deletion of folder C:\Programme\trans locks failed! Could not process line: C:\Programme\trans locks Status: 0xc0000034 Folder C:\Programme\iVideoCodec not found! Deletion of folder C:\Programme\iVideoCodec failed! Could not process line: C:\Programme\iVideoCodec Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload|ferrateen Deletion of registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload|ferrateen failed! Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload|clamoring Deletion of registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload|clamoring failed! Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{0d9eb558-0666-479e-868a-21b1d1a53bd1} Deletion of registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{0d9eb558-0666-479e-868a-21b1d1a53bd1} failed! Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{27321538-5739-4aa1-b84c-7d18e4383f1f} Deletion of registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{27321538-5739-4aa1-b84c-7d18e4383f1f} failed! Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|isamonitor.exe Deletion of registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|isamonitor.exe failed! Status: 0xc0000034 Could not delete registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|pmsngr.exe Deletion of registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|pmsngr.exe failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin not found! Deletion of registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACF3DAB0-D308-4B7A-BFE3-E6C0FAFEB1E7} not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACF3DAB0-D308-4B7A-BFE3-E6C0FAFEB1E7} failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iVideoCodec failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} failed! Status: 0xc0000034 Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} not found! Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} failed! Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate. |
|
|
|
|
|
|
03.11.2006, 15:40
Ehrenmitglied
Beiträge: 29434 |
#12
scanne mit option 1 und 2 und poste die reporte (lasse auch die registry mitreinigen)
http://virus-protect.org/artikel/tools/smitfrautfix.html ** scanne- stelle dann alles auf remove und poste den report http://virus-protect.org/counterspy.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
07.11.2006, 16:23
Member
Themenstarter Beiträge: 14 |
#13
*Zurück aus Gelsenkirchen ist*^^
SmitFraudFix v2.119 Scan done at 15:57:07,84, 07.11.2006 Run from C:\Dokumente und Einstellungen\Jan\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End Counterspy lässt sich nicht installieren.. kommt Meldung vonwegen das Script Host für den PC nicht aktiv ist.. oder so ^^ |
|
|
|
|
|
|
07.11.2006, 16:46
Ehrenmitglied
Beiträge: 29434 |
#14
Problem: Windows Script Host
Variante 1: falls xpantispy installiert ist, dort den Windows Script Host freischalten Hosts freischalten - mit dem xp-antispy Starten ==> unter "Diverse Einstellungen" [ ] Windows Scripting Host deaktivieren Davor den Haken wegnehmen und unten auf "Einstellungen Uebernehmen" klicken. Variante 2: Schau mal, ob es in der Registry (Start -> Ausführen -> regedit) bei dir unter: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings einen Eintrag mit dem Namen Enabled gibt. Wenn ja, dann weise diesem den Wert 1 zu, dann ist der Scripting Host wieder aktiviert. (dann den PC neustarten)  __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
07.11.2006, 18:20
Member
Themenstarter Beiträge: 14 |
#15
Spyware Scan Details
Start Date: 07.11.2006 17:42:20 End Date: 07.11.2006 18:17:39 Total Time: 35 mins 19 secs Detected spyware AntiLeech Plugin Adware (General) more information... Details: Plugin is an Ad-Ware software which enables the broadcasting of advertisements, and execution of e-commerce and other internet related services on the user-interface of the software. Status: Deleted Infected files detected E:\Programme\Anti-Leech\ALIE_1.0.2.3\alhlp.exe e:\Programme\Anti-Leech\ALIE_1.0.2.3\alie.dll Infected registry entries detected HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin HKEY_CURRENT_USER\Software\Anti-Leech\Anti-Leech Plugin Mozilla Firefox 1.0.7 E:\Programme\Mozilla Firefox\Plugins HKEY_CLASSES_ROOT\AntiLeech.ALIE.1 HKEY_CLASSES_ROOT\AntiLeech.ALIE.1\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7} HKEY_CLASSES_ROOT\AntiLeech.ALIE.1 Anti-Leech Plug-in HKEY_CLASSES_ROOT\AntiLeech.ALIE HKEY_CLASSES_ROOT\AntiLeech.ALIE\CLSID {056738EE-E15C-11D6-B876-0050BF5D85C7} HKEY_CLASSES_ROOT\AntiLeech.ALIE\CurVer AntiLeech.ALIE.1 HKEY_CLASSES_ROOT\AntiLeech.ALIE Anti-Leech Plug-in HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7} HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 E:\PROGRA~1\ANTI-L~1\ALIE_1~1.3\alie.dll HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\InprocServer32 ThreadingModel Apartment HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\ProgID AntiLeech.ALIE.1 HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\TypeLib {056738E1-E15C-11D6-B876-0050BF5D85C7} HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7}\VersionIndependentProgID AntiLeech.ALIE HKEY_CLASSES_ROOT\CLSID\{056738EE-E15C-11D6-B876-0050BF5D85C7} Anti-Leech Plug-in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE DisplayName Anti-Leech Plugin for Internet Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALIE UninstallString E:\Programme\Anti-Leech\ALIE_1.0.2.3\iesetup2.exe uninstall HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN DisplayName Anti-Leech Plugin for Mozilla, Opera, Netscape HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Anti-Leech ALNN UninstallString E:\Programme\Anti-Leech\ALNN\setup2.exe -u Messenger Plus! Adware Bundler more information... Details: Messenger Plus! is a add-on for MSN Messenger. Messenger Plus! installs an OPTIONAL adware called C2Media which is also known as LOP.com. Status: Deleted Infected files detected E:\Programme\MessengerPlus! 3\Detoured.dll E:\Programme\MessengerPlus! 3\Lame_enc.dll E:\Programme\MessengerPlus! 3\Libsndfile.dll E:\Programme\MessengerPlus! 3\RichEdHook.dll e:\programme\messengerplus! 3\msgplus.exe Infected registry entries detected HKEY_CURRENT_USER\Software\Patchou\MsgPlus2 HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\jan-hendrik_jacobsen@web.de\Archive\@IQaOfps]/ghG0ojepMuqlYBzp{0qbpmotebwkcS Type 2 HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\jan-hendrik_jacobsen@web.de\Archive\@IQaOfps]/ghG0ojepMuqlYBzp{0qbpmotebwkcS FilePath HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\jan-hendrik_jacobsen@web.de\Archive\@i_KUfpsi/gh_0{nkCKepmUmofwvivh_KU Type 2 HKEY_CURRENT_USER\Software\Patchou\MsgPlus2\jan-hendrik_jacobsen@web.de\Archive\@i_KUfpsi/gh_0{nkCKepmUmofwvivh_KU FilePath .. .. NetPumper Adware Bundler more information... Details: Bundles with a number of adware components. Status: Deleted Infected registry entries detected HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper\Affiliated\free\Firstrun state 2 HKEY_LOCAL_MACHINE\SOFTWARE\NetPumper VersionInfo OKvH6odVQypwBGbez4D9IpPKASNliv4uP6c7nYn5+8dhVX9tMbtxBYPaPgqTyQRDcbRldP628FVFhGBN9pz8JXG+OCkUu8CXuP5AoJeI2nJ2UOpcVKECwPN+0JTPV4BJS3NH5-7HOAshuHyncz6iHB5d0Rlg1McvA1oG-kWrF1lpSGY2orDSjIgFri6TxI8gUY3lmkFTEpSU HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B} HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{A8B0F390-E6BF-4027-A4D4-1E4363F5E27B} IAddUrl HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000} HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{A9E33220-0B05-11D7-88D2-444553540000} IAddPackage HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA} HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\ProxyStubClsid {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA}\ProxyStubClsid32 {00020424-0000-0000-C000-000000000046} HKEY_CLASSES_ROOT\Interface\{E0ABBF96-17DC-44CA-96D0-6217064A97BA} INetscapeInterface HKEY_CURRENT_USER\Software\NetPumper HKEY_CURRENT_USER\Software\NetPumper\Jan Field1 5003768 HKEY_CURRENT_USER\Software\NetPumper\Jan Field2 731416161 HKEY_CURRENT_USER\Software\NetPumper\Jan Field3 1707368574 HKEY_CURRENT_USER\Software\NetPumper\Jan Field4 1867745938 MyWebSearch Toolbar Potentially Unwanted Program more information... Details: MyWebSearch Toolbar is a customizable Internet Explorer search toolbar with various other tools. Status: Deleted Infected registry entries detected HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin\CurVer MyWebSearch.PseudoTransparentPlugin.1 HKEY_CLASSES_ROOT\MyWebSearch.PseudoTransparentPlugin MyWebSearch Pseudo Transparent Plugin C2.Lop Hijacker more information... Details: Lop is a group of spyware and hijacker programs that set your Internet Explorer start page and search features to use the site lop.com ('Live Online Portal') or one of its clone sites. Status: Deleted Infected registry entries detected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow dns-look-up.com HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow www.dns-look-up.com Trojan-Downloader.Zlob.Media-Codec Trojan Downloader more information... Details: Trojan-Downloader.Zlob.Media-Codec is a program that typically purports to be a needed upgrade to Windows Media Player in order to view adult oriented videos on certain websites. However, Trojan-Downloader.Zlob.Media-Codec actually downloads and installs Status: Deleted Infected registry entries detected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D} HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D}\iexplore Type 3 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D}\iexplore Count 140 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D}\iexplore Time Cookie: ad.yieldmanager Cookie (General) more information... Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count Status: Deleted Infected cookies detected c:\dokumente und einstellungen\jan\cookies\jan@ad.yieldmanager[1].txt Cookie: Radar Spy Cookie (General) more information... Details: Cookies are small "data tags" that web sites store on PCs in order to recognize unique visitors. Cookies are used to identify returning visitors who have registered for special services; to measure and analyze visitors' use of web site features; to count Status: Deleted Infected cookies detected c:\dokumente und einstellungen\jan\cookies\jan@tradedoubler[1].txt c:\dokumente und einstellungen\jan\cookies\jan@yourmedia[1].txt Das hier? weil da war sonst eig nix..^^ Dieser Beitrag wurde am 07.11.2006 um 23:34 Uhr von Sabina editiert.
|
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Wie der Threadname es schon sagt Habe ich Dieses Virus Burst dingens..
Habe die exen mit dem Dreieck gefunden und gelöscht ist auch weg aber dieses Fragezeichen is halt noch da >.< hab dann gegoogelt und die Seite gefunden (:
Kein Plan von nix (naja geht..^^)aber konnte entnehmen das ich das hier posten muss^^
Logfile of HijackThis v1.99.1
Scan saved at 23:24:22, on 01.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
E:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\TBPanel.exe
E:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\QuickTime\qttask.exe
E:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\vsnpstd2.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programme\Messenger\msmsgs.exe
E:\Programme\TuneUp Utilities 2006\MemOptimizer.exe
c:\progra~1\intern~1\iexplore.exe
E:\Programme\Logitech\SetPoint\SetPoint.exe
E:\Programme\AntiVir PersonalEdition Classic\sched.exe
E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
E:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Jan\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\programme\Adobe Reader\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {641BD7E9-5582-DD35-8E14-5F17768EE8A2} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - C:\Programme\iVideoCodec\isaddon.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [CTSysVol] E:\Programme\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [kinddartuperror] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\jugscashkinddart\browsestart.exe
O4 - HKCU\..\Run: [LDM] E:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "E:\Programme\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [one browse] C:\DOKUME~1\Jan\ANWEND~1\TRANSL~1\Shimabout.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = E:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = E:\Programme\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://E:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: bw+0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {4EDB0A1C-FAA2-4017-8C38-4B88B3CB5FF3} - E:\Programme\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - C:\WINDOWS\system32\rrtcany.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - E:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Und dann noch von combofix? oder?^^
Jan - 06-11-02 0:12:41,67 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Dokumente und Einstellungen\Jan\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-10-02 to 2006-11-02 ))))))))))))))))))))))))))))))))))
2006-11-01 23:07 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-11-01 23:07 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-11-01 23:07 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-11-01 23:07 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-11-01 19:55 106,496 --a------ C:\WINDOWS\system32\rrtcany.dll
2006-10-28 21:06 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2006-10-28 21:06 54,272 --a------ C:\WINDOWS\system32\vfwwdm32.dll
2006-10-28 21:05 61,440 --a------ C:\WINDOWS\system32\csnpstd2.dll
2006-10-28 21:05 57,344 --a------ C:\WINDOWS\system32\rsnpstd2.dll
2006-10-28 21:05 53,248 --a------ C:\WINDOWS\system32\dsnpstd2.dll
2006-10-28 21:05 53,248 --a------ C:\WINDOWS\amcap.exe
2006-10-28 21:05 36,864 --a------ C:\WINDOWS\system32\vsnpstd2.dll
2006-10-28 21:05 347,264 --a------ C:\WINDOWS\system32\drivers\snpstd2.sys
2006-10-28 21:05 286,720 --a------ C:\WINDOWS\vsnpstd2.exe
2006-10-28 21:05 20,480 --a------ C:\WINDOWS\usnpstd2.exe
2006-10-26 21:52 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.157-8876480SL.exe
2006-10-26 19:39 69,504 --a------ C:\WINDOWS\system32\drivers\LMOUKE.sys
2006-10-26 19:39 53,632 --a------ C:\WINDOWS\system32\drivers\L8042MOU.SYS
2006-10-26 19:39 13,056 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.SYS
2006-10-26 19:39 118,784 -r------- C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
2006-10-26 19:38 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2006-10-26 19:38 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2006-10-26 19:38 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2006-10-26 19:38 14,592 --a------ C:\WINDOWS\system32\drivers\LUsbKbd.sys
2006-10-26 19:38 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll
2006-10-26 19:37 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2006-10-22 01:43 2,321,408 --a------ C:\WINDOWS\system32\TUKernel.exe
2006-10-22 01:37 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll
2006-10-22 01:20 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-11-01 22:41 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\trans locks
2006-11-01 22:27 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-11-01 22:27 -------- d-------- C:\Programme\MUSICMATCH
2006-11-01 20:43 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-11-01 20:43 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\ScanSoft
2006-11-01 20:36 -------- d-------- C:\Programme\iVideoCodec
2006-11-01 19:50 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\.bittorrent
2006-11-01 19:41 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\OpenOffice.org2
2006-10-28 21:05 -------- d-------- C:\Programme\Trust
2006-10-28 07:15 130048 --a------ C:\WINDOWS\system32\SpoonUninstall.exe
2006-10-27 19:27 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2006-10-27 19:19 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\InstallShield
2006-10-26 19:43 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Logitech
2006-10-26 19:38 -------- d-------- C:\Programme\Gemeinsame Dateien\Logitech
2006-10-22 01:46 -------- d-------- C:\Programme\WinRAR
2006-10-22 01:36 -------- d-------- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2006-10-22 01:20 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-10-19 00:27 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\teamspeak2
2006-10-08 17:25 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Creative
2006-10-07 12:05 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\AdobeUM
2006-10-03 17:14 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Mozilla
2006-10-03 17:13 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Thunderbird
2006-09-27 22:49 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Skype
2006-09-22 23:16 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\IsoTeamGreat
2006-09-18 17:46 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\NetPumper
2006-09-18 16:56 -------- d-------- C:\Programme\trans locks
2006-09-17 16:43 -------- d-------- C:\Programme\Gemeinsame Dateien\Nullsoft
2006-09-15 14:47 -------- d-------- C:\Programme\AviSynth 2.5
2006-09-13 06:02 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-07 20:34 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Help
2006-09-06 17:35 -------- dr------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Brother
2006-09-06 17:14 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Xerox
2006-09-06 17:13 -------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield
2006-09-06 17:13 -------- d-------- C:\Programme\Common Files
2006-09-06 17:13 -------- d-------- C:\Programme\Brother
2006-09-06 17:10 -------- d-------- C:\Programme\ScanSoft
2006-09-05 17:38 737280 --a------ C:\WINDOWS\iun6002.exe
2006-09-03 20:48 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Real
2006-09-02 17:42 -------- d-------- C:\Dokumente und Einstellungen\Jan\Anwendungsdaten\Shareaza
2006-08-25 16:46 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-23 23:38 42920 --a------ C:\WINDOWS\system32\vsutil_loc0407.dll
2006-08-21 13:26 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 10:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-16 12:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"LDM"="E:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"
"MSMSGS"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background"
"TuneUp MemOptimizer"="\"E:\\Programme\\TuneUp Utilities 2006\\MemOptimizer.exe\" autostart"
"one browse"="C:\\DOKUME~1\\Jan\\ANWEND~1\\TRANSL~1\\Shimabout.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"avgnt"="\"E:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"CTSysVol"="E:\\Programme\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe"
"CTHelper"="CTHELPER.EXE"
"AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"Gainward"="C:\\WINDOWS\\TBPanel.exe /A"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"Zone Labs Client"="\"E:\\Programme\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"MessengerPlus3"="\"E:\\Programme\\MessengerPlus! 3\\MsgPlus.exe\""
"SNPSTD2"="C:\\WINDOWS\\vsnpstd2.exe"
"MSConfig"="C:\\WINDOWS\\PCHealth\\HelpCtr\\Binaries\\MSConfig.exe /auto"
"kinddartuperror"="C:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\jugscashkinddart\\browsestart.exe"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e0,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]
"isamonitor.exe"="C:\\Programme\\PornPass Manager\\isamonitor.exe"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"0aMCPClient"="{F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}"
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"ferrateen"="{27321538-5739-4aa1-b84c-7d18e4383f1f}"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Sinus 154 stick.lnk]
"path"="C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\Sinus 154 stick.lnk"
"backup"="C:\\WINDOWS\\pss\\Sinus 154 stick.lnkCommon Startup"
"location"="Common Startup"
"command"="E:\\PROGRA~1\\DT\\SINUS1~1\\Wifiusb.exe "
"item"="Sinus 154 stick"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^BitTorrent.lnk]
"path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\BitTorrent.lnk"
"backup"="C:\\WINDOWS\\pss\\BitTorrent.lnkStartup"
"location"="Startup"
"command"="E:\\PROGRA~1\\BITTOR~2\\BITTOR~1.EXE "
"item"="BitTorrent"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^OpenOffice.org 2.0.lnk]
"path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\OpenOffice.org 2.0.lnk"
"backup"="C:\\WINDOWS\\pss\\OpenOffice.org 2.0.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\OPENOF~1.0\\program\\QUICKS~1.EXE "
"item"="OpenOffice.org 2.0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^Trillian.lnk]
"path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\Trillian.lnk"
"backup"="C:\\WINDOWS\\pss\\Trillian.lnkStartup"
"location"="Startup"
"command"="E:\\Programme\\Trillian\\trillian.exe "
"item"="Trillian"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Jan^Startmenü^Programme^Autostart^Yahoo! Widget Engine.lnk]
"path"="C:\\Dokumente und Einstellungen\\Jan\\Startmenü\\Programme\\Autostart\\Yahoo! Widget Engine.lnk"
"backup"="C:\\WINDOWS\\pss\\Yahoo! Widget Engine.lnkStartup"
"location"="Startup"
"command"="E:\\Programme\\Yahoo!\\Yahoo! Widget Engine\\YahooWidgetEngine.exe "
"item"="Yahoo! Widget Engine"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQLite"
"hkey"="HKLM"
"command"="\"E:\\Programme\\ICQLite\\ICQLite.exe\" -minimize"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="iTunesHelper"
"hkey"="HKLM"
"command"="\"E:\\Programme\\iTunes\\iTunesHelper.exe\""
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msnmsgr"
"hkey"="HKCU"
"command"="\"C:\\Programme\\MSN Messenger\\msnmsgr.exe\" /background"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mwsoemon"
"hkey"="HKCU"
"command"="C:\\PROGRA~1\\MYWEBS~1\\bar\\1.bin\\mwsoemon.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\one browse]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Shimabout"
"hkey"="HKCU"
"command"="C:\\DOKUME~1\\Jan\\ANWEND~1\\TRANSL~1\\Shimabout.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSPVideo9]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pspVideo9"
"hkey"="HKLM"
"command"="E:\\Programme\\pspvideo9\\pspVideo9.exe -t"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="E:\\Programme\\CyberLink\\PowerDVD\\PDVDServ.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SB Audigy 2 Startup Menu]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"=" /L:GER"
"hkey"="HKCU"
"command"=" /L:GER"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Skype"
"hkey"="HKCU"
"command"="\"E:\\Programme\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Steam"
"hkey"="HKCU"
"command"="D:\\Valve\\Steam\\\\Steam.exe -silent"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SweetIM"
"hkey"="HKLM"
"command"="C:\\Programme\\Macrogaming\\SweetIM\\SweetIM.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="E:\\Programme\\Winamp\\winampa.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="YahooMessenger"
"hkey"="HKCU"
"command"="\"C:\\Programme\\Yahoo!\\Messenger\\YahooMessenger.exe\" -quiet"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Klick-Wartung.job
C:\WINDOWS\tasks\A895B3D891EE26F8.job
Completion time: 06-11-02 0:13:21.64
C:\ComboFix.txt ... 06-11-02 00:13
C:\ComboFix2.txt ... 06-11-01 23:38