Böse Datei bei automatischer Logfile-Auswertung HijackthisThema ist geschlossen! |
||
---|---|---|
Thema ist geschlossen! |
||
#0
| ||
11.12.2006, 19:02
Member
Beiträge: 21 |
||
|
||
11.12.2006, 19:16
Member
Beiträge: 130 |
#2
die einträge:
O1 - Hosts: 62.146.66.181 dl1.avgate.net O1 - Hosts: 62.146.66.182 dl2.avgate.net O1 - Hosts: 62.146.66.183 dl3.avgate.net O1 - Hosts: 62.146.66.184 dl4.avgate.net O1 - Hosts: 80.190.143.235 dl5.avgate.net O1 - Hosts: 80.190.143.236 dl6.avgate.net O1 - Hosts: 62.146.66.178 dl7.avgate.net O1 - Hosts: 62.146.66.179 dl8.freeav.net sind angeblich von antivir. daher nicht bösartig O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 Wobei der eintrag hier vermutlich nicht absichtlich ist. führe bitte alle punkte durch und poste die geforderten logs: http://board.protecus.de/t23188.htm punkt 1 hast du ja schon Dieser Beitrag wurde am 11.12.2006 um 19:20 Uhr von Terementor editiert.
|
|
|
||
11.12.2006, 20:02
Member
Themenstarter Beiträge: 21 |
#3
Hier sind die Logs:
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\Install.dat ((((((((((((((((((((((((((((((( Files Created from 2006-11-11 to 2006-12-11 )))))))))))))))))))))))))))))))))) 2006-12-11 19:51 <DIR> dr-h----- C:\Dokumente und Einstellungen\Biggi\Recent 2006-11-26 22:53 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2006-11-25 21:59 <DIR> d--h----- C:\Programme\Uninstall Information 2006-11-25 21:54 <DIR> d-------- C:\WINDOWS\WBEM 2006-11-25 21:54 <DIR> d-------- C:\WINDOWS\system32\de-de 2006-11-25 21:53 <DIR> d--h-c--- C:\WINDOWS\ie7 2006-11-25 21:52 121,856 --------- C:\WINDOWS\system32\xmllite.dll 2006-11-25 21:51 <DIR> d-------- C:\WINDOWS\network diagnostic 2006-11-17 19:13 <DIR> d-------- C:\Musik 2006-11-17 18:57 <DIR> d-------- C:\Programme\Ares 2006-11-16 12:41 <DIR> d-------- C:\Programme\MSXML 4.0 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-11 18:47 -------- d-------- C:\Programme\Hijackthis 2006-12-11 18:44 12546 --a------ C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\wklnhst.dat 2006-12-10 18:19 -------- d-------- C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\AdobeUM 2006-12-10 12:52 -------- d-------- C:\Programme\a-squared Free 2006-12-07 22:09 -------- d-------- C:\Programme\Trillian 2006-12-07 18:12 -------- d-------- C:\Programme\Music_Manager 2006-12-07 15:10 -------- d-------- C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\Azureus 2006-12-06 17:33 -------- d-------- C:\Programme\TuneUp Utilities 2006 2006-11-27 19:24 -------- d--h----- C:\Programme\InstallShield Installation Information 2006-11-27 18:20 83 ---hs---- C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\.zreglib 2006-11-25 21:58 -------- d-------- C:\Programme\Internet Explorer 2006-11-22 20:18 -------- d-------- C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\Google 2006-11-21 19:04 33280 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys 2006-11-13 17:35 -------- d-------- C:\Programme\Mozilla1.7.6 2006-11-10 19:28 -------- d-------- C:\Programme\eMule 2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll 2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll 2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll 2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll 2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll 2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll 2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll 2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll 2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll 2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll 2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll 2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe 2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll 2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll 2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe 2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll 2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll 2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll 2006-10-29 18:43 -------- d-------- C:\Programme\Google 2006-10-27 13:40 -------- d-------- C:\Programme\OXXOGames 2006-10-24 15:07 -------- d-------- C:\Dokumente und Einstellungen\Biggi\Anwendungsdaten\PhotoLine 2006-10-17 12:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll 2006-10-17 12:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll 2006-10-17 12:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe 2006-10-17 12:05 105984 --a------ C:\WINDOWS\system32\url.dll 2006-10-17 12:04 101376 --a------ C:\WINDOWS\system32\occache.dll 2006-10-17 12:03 17408 --a------ C:\WINDOWS\system32\corpol.dll 2006-10-17 11:58 61952 --------- C:\WINDOWS\system32\icardie.dll 2006-10-17 11:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe 2006-10-17 11:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll 2006-10-17 11:57 266752 --------- C:\WINDOWS\system32\iertutil.dll 2006-10-17 11:56 45568 --a------ C:\WINDOWS\system32\mshta.exe 2006-10-17 11:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll 2006-10-17 11:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll 2006-10-13 13:35 146432 --a------ C:\WINDOWS\system32\nwprovau.dll 2006-10-13 11:24 -------- d-------- C:\Programme\Spybot - Search & Destroy 2006-10-07 21:43 720896 --a------ C:\WINDOWS\iun6002.exe 2006-10-02 15:24 24072 --a------ C:\WINDOWS\system32\uxtuneup.dll 2006-09-13 06:02 1084416 --a------ C:\WINDOWS\system32\msxml3.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "updateMgr"="\"C:\\Programme\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_8 -reboot 1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "avgnt"="\"C:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Die derzeitige Homepage" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,00,03,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,04,00,00,40 "RestoredStateInfo"=hex:18,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:000000b1 "ClearRecentDocsOnExit"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000001 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 "DisableTaskMgr"=dword:00000001 "DisableRegistryTools"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "swg"="C:\\Programme\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "ATIPTA"="C:\\Programme\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "Keyboard Status"="C:\\PROGRA~1\\Medion\\KeyStat\\KeyStat.exe" "Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd" "AGRSMMSG"="AGRSMMSG.exe" "Adobe Photo Downloader"="\"C:\\Programme\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\"" "SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_08\\bin\\jusched.exe\"" "CloneCDTray"="\"C:\\Programme\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" ~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ backup-20060903-174304-845 O23 - Service: Boonty Games - BOONTY - C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\1-Klick-Wartung.job Completion time: 06-12-11 19:56:53.17 C:\ComboFix.txt ... 06-12-11 19:56 Datentr„ger in Laufwerk C: ist BOOT Volumeseriennummer: F0ED-29D3 Verzeichnis von C:\WINDOWS\system32 11.12.2006 19:52 2.206 wpa.dbl 11.12.2006 18:29 375.542 perfh009.dat 11.12.2006 18:29 51.340 perfc009.dat 11.12.2006 18:29 386.058 perfh007.dat 11.12.2006 18:29 62.166 perfc007.dat 11.12.2006 18:29 884.200 PerfStringBackup.INI 17.11.2006 18:54 1.040.384 ieframe.dll.mui 17.11.2006 18:53 12.288 advpack.dll.mui 08.11.2006 02:38 10.342.824 MRT.exe 07.11.2006 21:03 6.049.280 ieframe.dll 07.11.2006 21:03 50.688 msfeedsbs.dll 07.11.2006 21:03 191.488 iepeers.dll 07.11.2006 21:03 131.584 extmgr.dll 07.11.2006 21:03 475.648 mshtmled.dll 07.11.2006 21:03 231.424 webcheck.dll 07.11.2006 21:03 3.577.856 mshtml.dll 07.11.2006 21:03 458.752 msfeeds.dll 07.11.2006 21:03 180.736 ieui.dll 07.11.2006 21:03 27.136 jsproxy.dll 07.11.2006 21:03 670.720 mstime.dll 07.11.2006 21:03 1.162.240 urlmon.dll 07.11.2006 21:03 818.688 wininet.dll 07.11.2006 21:03 156.160 msls31.dll 07.11.2006 21:03 413.696 vbscript.dll 07.11.2006 03:27 382.976 iedkcs32.dll 07.11.2006 03:27 229.376 ieaksie.dll 07.11.2006 03:26 152.064 ieakeng.dll 07.11.2006 03:26 71.680 admparse.dll 07.11.2006 03:26 55.296 iesetup.dll 07.11.2006 03:26 13.312 ieudinit.exe 07.11.2006 03:26 54.784 ie4uinit.exe 07.11.2006 03:26 43.008 iernonce.dll 07.11.2006 03:26 92.672 inseng.dll 07.11.2006 03:26 123.904 advpack.dll 07.11.2006 03:25 161.792 ieakui.dll 07.11.2006 03:24 56.483 ieuinit.inf 04.11.2006 14:14 1.245.696 msxml4.dll 25.10.2006 18:43 305.768 FNTCACHE.DAT 17.10.2006 12:06 443.904 html.iec 17.10.2006 12:06 78.336 ieencode.dll 17.10.2006 12:05 206.336 WinFXDocObj.exe 17.10.2006 12:05 1.817.088 inetcpl.cpl 17.10.2006 12:05 105.984 url.dll 17.10.2006 12:05 40.960 licmgr10.dll 17.10.2006 12:05 192.000 msrating.dll 17.10.2006 12:04 101.376 occache.dll 17.10.2006 12:03 17.408 corpol.dll 17.10.2006 12:00 491.520 jscript.dll 17.10.2006 11:58 12.288 msfeedssync.exe 17.10.2006 11:58 61.952 icardie.dll 17.10.2006 11:58 44.544 pngfilt.dll 17.10.2006 11:58 346.624 dxtmsft.dll 17.10.2006 11:57 36.352 imgutil.dll 17.10.2006 11:57 214.528 dxtrans.dll 17.10.2006 11:57 266.752 iertutil.dll 17.10.2006 11:56 45.568 mshta.exe 17.10.2006 11:55 66.560 tdc.ocx 17.10.2006 11:28 48.128 mshtmler.dll 17.10.2006 11:27 380.928 ieapfltr.dll 17.10.2006 11:19 1.383.424 mshtml.tlb 16.10.2006 12:19 270.336 xpsp3res.dll 13.10.2006 13:35 146.432 nwprovau.dll 02.10.2006 15:24 24.072 uxtuneup.dll Datentr„ger in Laufwerk C: ist BOOT Volumeseriennummer: F0ED-29D3 Verzeichnis von C:\ 11.12.2006 20:00 0 sys.txt 11.12.2006 20:00 35.816.638 wialog.txt 11.12.2006 20:00 11.048 system.txt 11.12.2006 20:00 124 systemtemp.txt 11.12.2006 19:59 102.693 system32.txt 11.12.2006 19:56 9.878 ComboFix.txt 11.12.2006 18:27 1.073.270.784 hiberfil.sys 11.12.2006 18:27 1.610.612.736 pagefile.sys 07.12.2006 17:22 20.223 hpfr5550.log 20.09.2006 18:06 225 boot.ini Datentr„ger in Laufwerk C: ist BOOT Volumeseriennummer: F0ED-29D3 Verzeichnis von C:\WINDOWS 11.12.2006 18:29 6.104 ModemLog_Bluetooth DUN Modem.txt 11.12.2006 18:29 0 0.log 11.12.2006 18:29 4.568 ModemLog_Creatix V.92 Data Fax Modem.txt 11.12.2006 18:29 2.020 ModemLog_Bluetooth Fax Modem.txt 11.12.2006 18:29 159 wiadebug.log 11.12.2006 18:29 1.298.636 WindowsUpdate.log 11.12.2006 18:28 50 wiaservc.log 11.12.2006 18:27 2.048 bootstat.dat 11.12.2006 18:25 32.538 SchedLgU.Txt 10.12.2006 17:05 2.490 ModemLog_Bluetooth LAP Modem.txt 10.12.2006 17:05 2.402 ModemLog_Bluetooth LAP Modem #2.txt 10.12.2006 12:49 116 NeroDigital.ini 07.12.2006 17:19 302 datarecs.Ini 04.12.2006 18:26 282.952 setupapi.log 27.11.2006 13:38 96.127 DirectX.log 26.11.2006 22:58 870 win.ini 25.11.2006 22:00 8.961 spupdsvc.log 25.11.2006 21:54 23.126 ie7_main.log 25.11.2006 21:54 161.342 comsetup.log 25.11.2006 21:54 27.004 ocmsn.log 25.11.2006 21:54 81.911 iis6.log 25.11.2006 21:54 99.655 ntdtcsetup.log 25.11.2006 21:54 198.268 tsoc.log 25.11.2006 21:54 1.393 imsins.log 25.11.2006 21:54 65.837 ie7.log 25.11.2006 21:54 242.234 ocgen.log 25.11.2006 21:54 24.335 msgsocm.log 25.11.2006 21:54 487.668 FaxSetup.log 25.11.2006 21:54 61.390 updspapi.log 25.11.2006 21:53 1.393 imsins.BAK 25.11.2006 21:53 13.249 IDNMitigationAPIs.log 25.11.2006 21:52 11.615 NLSDownlevelMapping.log 25.11.2006 21:52 8.578 KB915865.log 25.11.2006 21:51 6.281 KB914440.log 25.11.2006 21:51 23.034 KB920213.log 25.11.2006 21:51 12.217 KB904942.log 19.11.2006 20:30 14.069 setupact.log 18.11.2006 19:05 47.984 wmsetup.log 16.11.2006 12:41 16.386 KB923980.log 16.11.2006 12:41 16.402 KB924270.log 16.11.2006 12:41 17.710 KB922760.log 04.11.2006 17:22 10 popcinfo.dat 24.10.2006 15:10 2.359.350 wallpaper.bmp 12.10.2006 21:26 15.070 KB924191.log 12.10.2006 21:26 14.563 KB922819.log 12.10.2006 21:26 12.759 KB923414.log 12.10.2006 21:25 13.049 KB924496.log 12.10.2006 21:25 10.252 KB923191.log 07.10.2006 21:43 720.896 iun6002.exe 01.10.2006 01:11 10.550 KB925486.log Datentr„ger in Laufwerk C: ist BOOT Volumeseriennummer: F0ED-29D3 Verzeichnis von C:\DOKUME~1\Biggi\LOKALE~1\Temp Gruß Lara |
|
|
||
12.12.2006, 13:23
Ehrenmitglied
Beiträge: 29434 |
#4
lara20
0. öffne das HijackThis -- Button "scan" -- vor diese Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Zitat O1 - Hosts: 62.146.66.181 dl1.avgate.net1. Avenger http://virus-protect.org/artikel/tools/avenger.html kopiere rein Zitat Registry values to delete:Klicke die grüne Ampel das Script wird nun ausgeführt, dann wird der PC automatisch neustarten 2. Hoster.zip http://www.funkytoad.com/download/hoster.zip Press 'Restore Original Hosts' and press 'OK' Exit Program. 3. scanne und poste den scanreport http://virus-protect.org/counterspy.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
||
12.12.2006, 14:26
Member
Themenstarter Beiträge: 21 |
#5
Hallo Sabina,
ich kann counterspy leider nicht installieren. Es erscheint die Meldung: Der Zugriff auf Windows Script Host wurde für diesen Computer deaktiviert. Wenden Sie sich an Ihren Administrator, um weitere Details in Erfahrung zu bringen. Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Was ist denn jetzt passiert? Lieben Gruß Lara Liebe Sabina, habe counterspy doch installiert bekommen. Hier ist der Scan-Report: Spyware Scan Details Start Date: 12.12.2006 15:12:24 End Date: 12.12.2006 15:31:46 Total Time: 19 mins 22 secs Detected spyware RealVNC Commercial Remote Control more information... Details: VNC (Virtual Network Computing) software makes it possible to view and fully-interact with one computer from any other computer or mobile device anywhere on the Internet. Status: Ignored Infected registry entries detected HKEY_LOCAL_MACHINE\Software\ORL Liebe Grüße Lara Dieser Beitrag wurde am 12.12.2006 um 15:37 Uhr von lara20 editiert.
|
|
|
||
12.12.2006, 15:53
Ehrenmitglied
Beiträge: 29434 |
#6
lasse den eintrag, den counterpsy gefunden hat per "remove" loeschen.
dann poste das neue log vom HijackThis __________ MfG Sabina rund um die PC-Sicherheit |
|
|
||
12.12.2006, 16:18
Member
Themenstarter Beiträge: 21 |
#7
Hier ist das Logfile:
Logfile of HijackThis v1.99.1 Scan saved at 16:17:05, on 12.12.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Programme\Mozilla1.7.6\mozilla.exe C:\WINDOWS\system32\msiexec.exe C:\Programme\Sunbelt Software\CounterSpy\Consumer\Thread.exe C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunServer.exe C:\Programme\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/ O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{CC32E40C-7D6A-4C7B-8C3B-8923F7D8B79E}: NameServer = 213.191.92.82 213.191.74.11 O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe Gruß Lara |
|
|
||
12.12.2006, 17:14
Ehrenmitglied
Beiträge: 29434 |
#8
fixe mit dem hijackthis:
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) neustarten »» poste das neue log vom HijackThis __________ MfG Sabina rund um die PC-Sicherheit |
|
|
||
12.12.2006, 17:46
Member
Themenstarter Beiträge: 21 |
#9
Hier ist das Logfile
Logfile of HijackThis v1.99.1 Scan saved at 17:45:52, on 12.12.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programme\Sunbelt Software\CounterSpy\Consumer\Thread.exe C:\Programme\Sunbelt Software\CounterSpy\Consumer\SunProtectionServer.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe C:\Programme\Mozilla1.7.6\mozilla.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunServer] C:\Programme\Sunbelt Software\CounterSpy\Consumer\sunserver.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/ O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{CC32E40C-7D6A-4C7B-8C3B-8923F7D8B79E}: NameServer = 213.191.92.82 213.191.74.11 O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe Liebe Grüße Lara |
|
|
||
13.12.2006, 00:46
Ehrenmitglied
Beiträge: 29434 |
||
|
||
13.12.2006, 06:56
Member
Themenstarter Beiträge: 21 |
#11
Guten Morgen Sabina,
vielen lieben Dank für die schnelle Hilfe. Ihr seid, wie immer, einfach nur klasse. Liebe Grüße Lara |
|
|
||
ich habe das Logfile von Hijackthis automatisch auswerten lassen und mir wurden 8 eventuell böse und eine böse Datei gemeldet.
Bitte schaut Euch das Logfile doch einmal an.
Logfile of HijackThis v1.99.1
Scan saved at 18:47:21, on 11.12.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\Programme\Mozilla1.7.6\mozilla.exe
C:\Programme\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O1 - Hosts: 62.146.66.181 dl1.avgate.net
O1 - Hosts: 62.146.66.182 dl2.avgate.net
O1 - Hosts: 62.146.66.183 dl3.avgate.net
O1 - Hosts: 62.146.66.184 dl4.avgate.net
O1 - Hosts: 80.190.143.235 dl5.avgate.net
O1 - Hosts: 80.190.143.236 dl6.avgate.net
O1 - Hosts: 62.146.66.178 dl7.avgate.net
O1 - Hosts: 62.146.66.179 dl8.freeav.net
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC32E40C-7D6A-4C7B-8C3B-8923F7D8B79E}: NameServer = 213.191.92.82 213.191.74.11
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
Vielen Dank für Eure Hilfe
Lieben Gruß Lara