Wieder mal ein "Critical System Errors!" Problem

#1 Habe auch das Tolle Problem. Habe mich schon durch viele viele Seiten geklickt und immerhin die "Security Task im i-explorer wegbekommen.
habe aber immernoch das wunderschöne Taskleisten-Symbol "Critical System Errors!".

Hoffe mir kann jemand helfen!


Logfile of HijackThis v1.99.1
Scan saved at 18:43:22, on 06.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINSOWS\System32\smss.exe
F:\WINSOWS\system32\winlogon.exe
F:\WINSOWS\system32\services.exe
F:\WINSOWS\system32\lsass.exe
F:\WINSOWS\system32\Ati2evxx.exe
F:\WINSOWS\system32\svchost.exe
F:\WINSOWS\System32\svchost.exe
F:\WINSOWS\system32\Ati2evxx.exe
F:\Programme\TGTSoft\StyleXP\StyleXPService.exe
F:\WINSOWS\Explorer.EXE
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
F:\WINSOWS\system32\spoolsv.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
F:\Programme\VidCodecs\isamonitor.exe
F:\Programme\VidCodecs\isamini.exe
F:\Programme\VidCodecs\pmsngr.exe
F:\winsows\system32\rlvknlg.exe
F:\Programme\VidCodecs\pmmon.exe
F:\Programme\Java\jre1.5.0_09\bin\jusched.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
F:\WINSOWS\system32\ctfmon.exe
F:\Programme\Internet Explorer\IEXPLORE.EXE
F:\Programme\Internet Explorer\IEXPLORE.EXE
F:\Programme\Messenger\msmsgs.exe
F:\Dokumente und Einstellungen\Dennis Dziadkowiak\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {274c0420-ebe0-4f1d-b473-edd1aa9b85dd} - F:\Programme\VidCodecs\isaddon.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [RelevantKnowledge] f:\winsows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Programme\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "F:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINSOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] F:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MSMSGS] "F:\Programme\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - F:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - F:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O10 - Unknown file in Winsock LSP: f:\winsows\system32\spacklsp.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1CF2AB7-0D7A-42CE-A7E1-6F270EAD9311}: NameServer = 217.237.149.161 217.237.150.115
O21 - SSODL: detachments - {01d8d081-0f76-4ab5-b5e4-9b23a709670e} - F:\WINSOWS\system32\sacskza.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINSOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINSOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007.SP1\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2007.SP1\RpcSandraSrv.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: StyleXPService - Unknown owner - F:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: T-Online DSL-Manager (TODslService) - T-Systems International GmbH - F:\Programme\T-Online\DSL-Manager\TODslSvc.exe

#2 Avenger
http://virus-protect.org/artikel/tools/avenger.html
kopiere rein

Zitat

Registry values to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler|{01d8d081-0f76-4ab5-b5e4-9b23a709670e}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload|detachments
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|isamonitor.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|pmsngr.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|wininet.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run|RelevantKnowledge

registry keys to delete:
HKEY_LOCAL_MACHINE\software\netsetter\osmim
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\EMediaCodek.Chl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PlayVideoEnchancer.chl
HKEY_LOCAL_MACHINE\software\classes\typelib\{169c7855-c096-4d45-803b-6441552a7e92}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VidCodecs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\VidCodecs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{274c0420-ebe0-4f1d-b473-edd1aa9b85dd}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1a29a79a-b9c8-44a9-bedf-7fadde3cf33f}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACF3DAB0-D308-4B7A-BFE3-E6C0FAFEB1E7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\VirusBursters
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virusbursters.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusBursters
HKEY_LOCAL_MACHINE\SOFTWARE\VirusBursters

Files to delete:
F:\WINDOWS\system32\sacskza.dll
f:\windows\system32\rlvknlg.exe
f:\windows\system32\okshook.dll
f:\windows\system32\osmim.dll
f:\windows\downloaded program files\nsconfig.dll

Folders to delete:
F:\Programme\VidCodecs
F:\Programme\VirusBursters

Klicke die grüne Ampel
das Script wird nun ausgeführt, dann wird der PC automatisch neustarten

»»
lösche das Backup vom Avenger unter C:\Avenger\backup.zip + leere den Papierkorb

««
scanne mit smitfraudfix - Option 1 und 2 ( lasse auch die Registry mitreinigen)
http://virus-protect.org/artikel/tools/smitfrautfix.html

**
Deinstalliere: RelevantKnowledge - NetSetter/Marketscore foistware

Zitat

rlvknlg.exe is a process belonging to RelevantKnowledge Adware. This process should be removed to ensure your personal privacy.

«
__________
MfG Sabina

rund um die PC-Sicherheit

#3 Hammer, vielen vielen dank!

Wirklich echt cooles forum.

Werde euch weiterempfehlen!

Bis zum nächsten Problem