pc-on-internet.com Belastung |
||
|---|---|---|
| #0
| ||
|
12.05.2008, 09:30
...neu hier
Beiträge: 7 |
||
 
|
|
|
|
12.05.2008, 10:06
Ehrenmitglied
 Beiträge: 29434 |
#2
Hallo keithdean
1. wende cleaner an + lösche die temp-Dateien http://www.ccleaner.de/?protecus.de 2. mit dem HijackThis löschen ("fixen") Klicke: "Do a system scan only" Setze ein Häckchen in das Kästchen vor den genannten Eintrag und wähle fix checked. + starte den Rechner neu. Zitat R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb3. wende Combofix an /Warnmeldung wegklicken) + poste hier den report http://virus-protect.org/artikel/tools/combofix.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
12.05.2008, 12:51
...neu hier
Themenstarter Beiträge: 7 |
#3
Hello. Danke für Ihren Antwort.
Habe Hijackthis durchgeführt und Einträge entfernt. Aber Combofix funktionert nicht bei mir. Beim Durchführung kommt keine Meldung wo ich "1" schreiben( disclaimer of warranty on software) und enter klicke. Es macht sofort eine Systemwiederherstellungpunkt und dann geht es nicht weiter. Was soll ich jetzt machen. Danke. Keith Dean |
|
|
|
|
|
|
12.05.2008, 13:02
Ehrenmitglied
Beiträge: 29434 |
#4
Hallo,
poste die 2 logs von Comboscan http://virus-protect.org/artikel/tools/comboscan.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
12.05.2008, 14:29
...neu hier
Themenstarter Beiträge: 7 |
#5
Hier ist extra.txt. Main.txt ist als Anhang
Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft® Windows Vista™ Home Premium (build 6001) SP 1.0 Architecture: X86; Language: German CPU 0: AMD Athlon(tm) 64 X2 Dual Core Processor 4600+ Percentage of Memory in Use: 42% Physical Memory (total/avail): 2045.84 MiB / 1173.09 MiB Pagefile Memory (total/avail): 4336.2 MiB / 3093.93 MiB Virtual Memory (total/avail): 2047.88 MiB / 1894.23 MiB C: is Fixed (NTFS) - 232.88 GiB total, 108.54 GiB free. D: is CDROM (CDFS) E: is CDROM (No Media) F: is Removable (No Media) G: is Removable (No Media) H: is Removable (No Media) I: is Removable (No Media) J: is Removable (No Media) \\.\PHYSICALDRIVE0 - WDC WD2500JS-55NCB1 ATA Device - 232.88 GiB - 1 partition \PARTITION0 (bootable) - Installierbares Dateisystem - 232.88 GiB - C: \\.\PHYSICALDRIVE1 - Generic 2.0 Reader -0 USB Device \\.\PHYSICALDRIVE2 - Generic 2.0 Reader -1 USB Device \\.\PHYSICALDRIVE3 - Generic 2.0 Reader -2 USB Device \\.\PHYSICALDRIVE4 - Generic 2.0 Reader -3 USB Device \\.\PHYSICALDRIVE5 - Generic 2.0 Reader -4 USB Device -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. AV: AVG 7.5.524 v7.5.524 (Grisoft) AS: Windows-Defender v1.1.1505.0 (Microsoft Corporation) [COLOR=RED]Disabled[/COLOR] AS: SUPERAntiSpyware v4, 0, 0, 1154 (SUPERAntiSpyware.com) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Programme\\Bonjour\\mDNSResponder.exe"="C:\\PROGRA~1\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour" "C:\\Programme\\EA SPORTS\\FIFA 07\\fifa07.exe"="C:\\PROGRA~1\\EA SPORTS\\FIFA 07\\fifa07.exe:*:Enabled:fifa07" "C:\\Programme\\Messenger\\msmsgs.exe"="C:\\PROGRA~1\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Programme\\Microsoft Games\\Age of Empires III\\age3.exe"="C:\\PROGRA~1\\Microsoft Games\\Age of Empires III\\age3.exe:*:Enabled:Age of Empires 3" -- Environment Variables ------------------------------------------------------- COMPUTERNAME=ARJUNA ComSpec=C:\Windows\system32\cmd.exe DEFAULT_CA_NR=CA8 FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Users\Dean LOCALAPPDATA=C:\Users\Dean\AppData\Local LOGONSERVER=\\ARJUNA -- User Profiles --------------------------------------------------------------- Dean Administrator (new local) Gast (guest) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 3D Desktop Jigsaw Puzzle Screensaver v1.0 Registered Version --> "C:\Program Files\UselessCreations\Jigsaw3D\uninst.exe" 3Planesoft Screensaver Manager 1.1 --> "C:\Program Files\3Planesoft Screensaver Manager\unins000.exe" Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF} Adlerflug 3D --> C:\Windows\Adlerflug3DUninstaller.exe Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 8.1.2 - Deutsch --> MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A81200000003} Adobe Shockwave Player --> C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log Age of Empires III --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{A8CF5C37-8EC5-4C33-BB4A-87F468B77D45} Age Of Pirates - Caribbean Tales 1.41 --> "C:\Program Files\Playlogic\Age of Pirates - Caribbean Tales\unins000.exe" Anfy --> C:\PROGRA~1\AnfyTeam\UNWISE.EXE C:\PROGRA~1\AnfyTeam\INSTALL.LOG Animated Waterfalls --> C:\Windows\unins000.exe Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} AusLogics Disk Defrag --> "C:\Program Files\AusLogics Disk Defrag\unins000.exe" AVG 7.5 --> C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL BearShare --> C:\PROGRA~1\BEARSH~2\UNWISE.EXE C:\PROGRA~1\BEARSH~2\INSTALL.LOG Bildstoerung 4.00 --> C:\Program Files\Bildstoerung\uninstall.exe Blender (remove only) --> "C:\Program Files\Blender Foundation\Blender\uninstall.exe" Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3} Canon Internet Library for ZoomBrowser EX --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2F81FBFC-9A37-431F-9050-14B55485DF5A} Canon MP Navigator EX 1.0 --> "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator EX 1.0\uninst.ini Canon MP220 series --> "C:\Windows\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP220_series\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP220_series /L0x0007 Canon MP220 series Benutzerregistrierung --> C:\Program Files\Canon\IJEREG\MP220 series\UNINST.EXE Canon My Printer --> C:\Program Files\Canon\MyPrinter\uninst.exe uninst.ini Canon Utilities Easy-PhotoPrint EX --> C:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe uninst.ini Canon Utilities Solution Menu --> C:\Program Files\Canon\SolutionMenu\uninst.exe uninst.ini Canon Utilities ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe" "C:\PROGRA~1\Canon\ZoomBrowser EX\Program\Uninst.ini" CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" CDDRV_Installer --> MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A} Classic FTP --> C:\Program Files\NCH Software\ClassicFTP\uninst.exe CloneDVD2 --> "C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2" Crazy Frog Saver 1 --> C:\Program Files\Crazy Frog Saver 1\uninstall.exe Disc2Phone --> MsiExec.exe /X{925936AC-9C9A-4897-874B-60961AAB6D52} EA SPORTS online 2007 --> C:\Program Files\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe EarthBrowser --> MsiExec.exe /X{C2FD6E70-984F-4562-81D3-0A27A8BEF2EE} Feederkennung (Windows Live Toolbar) --> MsiExec.exe /X{EBA672FF-F80E-48B1-8FC4-616825318810} FIFA 07 --> C:\Program Files\EA SPORTS\FIFA 07\eauninstall.exe FlatOut2 --> MsiExec.exe /I{7E641E46-81DB-4D1D-906A-48342523051C} FlightGear v1.0.0 --> "C:\Program Files\FlightGear\unins000.exe" Fling --> C:\Program Files\NCH Software\Fling\uninst.exe Free Natural Text to Speech Reader 2007 --> MsiExec.exe /I{3E5DA526-F420-45A6-9F27-D2B5246D6823} GameShadow --> MsiExec.exe /I{5A2F371F-8B5D-46B4-833C-0612B065BEC7} GIMP 2.4.4 --> "C:\Program Files\GIMP-2.0\setup\unins000.exe" Google Desktop --> C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72} Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll" HdR Die Rückkehr des Königs tm --> C:\Program Files\EA GAMES\HdR Die Rückkehr des Königs tm\EAUninstall.exe Hervorhebe-Funktion (Windows Live Toolbar) --> MsiExec.exe /X{00D0200F-3B4D-4A2F-869E-533ED835A943} HijackThis 2.0.2 --> "C:\Users\Dean\Desktop\HijackThis.exe" /uninstall ICQ Toolbar --> regsvr32 /u /s "C:\PROGRA~1\ICQTOO~1\4516\toolbaru.dll" ICQ6 --> "C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly IKEA Home Planner --> MsiExec.exe /I{A987FEC8-5616-49BD-BCA6-ACFFFE7403FE} InternetGameBox --> C:\Program Files\InternetGameBox\uninst.exe ISO Recorder --> MsiExec.exe /I{39600969-41C3-4658-876E-16F108FC5C92} iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} J2SE Runtime Environment 5.0 Update 10 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150100} J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} Java(TM) 6 Update 3 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030} Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010} Kaminfeuer Titanium Edition 1.2 --> C:\Windows\ST5UNST.EXE -n "C:\Program Files\Kaminfeuer Titanium Edition 1.2\ST5UNST.LOG" KhalInstallWrapper --> MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355} Lantern 3D Screensaver 1.0 --> "C:\Program Files\Lantern 3D Screensaver\unins000.exe" LifeGlobe Goldfish Aquarium 2.0 --> "C:\Program Files\Prolific Publishing, Inc\Goldfish Aquarium 2.0\unins000.exe" LingoPad 2.5.1 (Build 325) --> "C:\Program Files\LingoPad\unins000.exe" Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\setup.exe" -l0x7 UNINSTALL Logitech SetPoint --> C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x0007 -removeonly Maggots! --> C:\Windows\ST5UNST.EXE -n "C:\Program Files\Maggots!\ST5UNST.LOG" Messenger Plus! Live --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe" Microsoft .NET Framework 1.1 --> msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 --> MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1 Hotfix (KB929729) --> "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp" Microsoft Flight Simulator X --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{F535B2CF-C9BB-4162-B03A-02D6971F32CC} Microsoft Flight Simulator X --> MsiExec.exe /X{F535B2CF-C9BB-4162-B03A-02D6971F32CC} Microsoft Flight Simulator X Service Pack 1 --> c:\Windows\system32\msiexec.exe /qb /l*vx "%TEMP%\FlightSimPatchUninstall.log" /uninstall {7FB5887E-FA27-4CDC-BBA4-146487E789FA} /package {F535B2CF-C9BB-4162-B03A-02D6971F32CC} Microsoft Office Professional Edition 2003 --> MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9} Microsoft Reader Text-to-Speech deutsch --> MsiExec.exe /X{A06F5ACB-AF59-4DC0-B22E-1F6F47FC7004} Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00} Microsoft SQL Server 2005 Compact Edition [ENU] --> MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Microsoft Works --> MsiExec.exe /I{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3} Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Mozilla Firefox (3.0b4) --> C:\Program Files\Mozilla Firefox 3 Beta 4\uninstall\helper.exe MSXML 4.0 SP2 (KB927978) --> MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F} MSXML 4.0 SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} MSXML 4.0 SP2 Parser and SDK --> MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC} MSXML 6.0 Parser --> MsiExec.exe /I{AEB9948B-4FF2-47C9-990E-47014492A0FE} MyPhoneExplorer --> C:\Program Files\MyPhoneExplorer\uninstall.exe neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NoLimits Coasters Demo 1.55 (remove only) --> "C:\Program Files\NoLimits Coasters Demo v1.55\uninstall.EXE" NVIDIA Drivers --> C:\Windows\system32\nvudisp.exe UninstallGUI Opera 9.27 --> MsiExec.exe /X{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0} phase5 --> "C:\Program Files\phase5\uninstall.exe" Photocolor Bestellsoftware 3.5 --> C:\Program Files\Photocolor\OrderClient35\Uninstall.exe Pirates of the Caribbean - At Worlds End --> C:\Program Files\InstallShield Installation Information\{01CBFCE7-95AD-40F3-BC63-C46EFB2FC9C4}\setup.exe -runfromtemp -l0x0007 Pirates of the Caribbean - At Worlds End -removeonly Pirates Screen Saver --> C:\Windows\system32\Pirates.scr /u PIXMA Extended Survey Program --> C:\Program Files\Canon\IJPLM\SETUP.EXE -R Probeversion von World of Warcraft --> C:\Users\Public\Documents\Blizzard Entertainment\World of Warcraft Trial\Uninstall.exe QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} QuickTime 3.0 --> C:\Windows\unin0407.exe -f"C:\Program Files\QuickTime\DeIsL1.isu" -c"C:\Windows\system32\QTUninst.dll RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 RealSpeak Solo fur Deutsch - Steffi --> MsiExec.exe /I{BFBB91DB-9F0F-4A9C-9669-A97DA3512CF2} Realtek High Definition Audio Driver --> RtlUpd.exe -r -m Registry Mechanic 7.0 --> "C:\Program Files\Registry Mechanic\unins000.exe" Ripples beta 0.9.6 --> "C:\Program Files\Ripples\unins000.exe" Safari --> MsiExec.exe /I{40589552-3892-409E-B92C-9F5032A4B2F0} ScanSoft OmniPage SE 4 --> MsiExec.exe /X{DEE88727-779B-47A9-ACEF-F87CA5F92A65} SDFormatter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5A347920-4AFC-11D5-9FB0-800649886934}\setup.exe" Secunia PSI (RC1) --> "C:\Program Files\Secunia\PSI (RC1)\uninstall.exe" Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A} SiSoftware Sandra Lite XII.SP1 --> "C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\unins000.exe" Ski Challenge 2008 --> "C:\Games\Ski Challenge 2008 (SF)\uninstall.exe" SC08-CH_SF Smart Menus (Windows Live Toolbar) --> MsiExec.exe /X{2DD6C198-FA9A-40B4-8DE5-CE5206E3EB34} Sony Ericsson Device Data --> MsiExec.exe /I{C92E7DF1-624A-4D95-A4C4-18CB491B44A4} Sony Ericsson Drivers --> MsiExec.exe /I{C60BA916-9E44-4DA4-B11A-9E27B7624EF5} Sony Ericsson PC Suite --> C:\Windows\Installer\{D6BF6477-8369-489F-8DE6-3731F4B88560}\Setup.exe /uninstall Sony Ericsson PC Suite --> MsiExec.exe /I{345CDDCB-8241-4E76-9D3B-155F2FD6F07E} Spelling Dictionaries Support For Adobe Reader 8 --> MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003} Spider-Man 3 (TM) --> C:\Program Files\InstallShield Installation Information\{990166FA-1ACB-4AA7-B592-4D370C7CDD1A}\setup.exe -runfromtemp -l0x0407 Stronghold Legends --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{66A405D2-BA14-4594-BF36-B3B544F0754E}\setup.exe" -l0x7 -removeonly StuffPlug 3 --> C:\Program Files\StuffPlug3\Uninstall.exe Super Castle Attack --> C:\Program Files\Super Castle Attack\SXUNINST.EXE SUPERAntiSpyware Professional --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA} SweetIM for Messenger 2.5 --> MsiExec.exe /X{EC6BD2CC-2DCF-4AD8-A8DD-DF89D29EEF3F} SweetIM Toolbar for Internet Explorer 3.1 --> MsiExec.exe /X{59971D79-8111-42C2-9E40-883A0C277E78} Ten Thumbs 4.3.1 --> MsiExec.exe /I{68F54760-76E1-4067-B7D7-01F787AB0AA0} The One Ring 3D Screensaver 1.0 --> "C:\Program Files\The One Ring 3D Screensaver\unins000.exe" UpdateStar --> MsiExec.exe /X{7B049115-744F-4827-B032-331E2BA27831} VeohTV BETA --> C:\Program Files\InstallShield Installation Information\{D1B11537-EA51-4DD8-BF1E-098BEE48868D}\setup.exe -runfromtemp -l0x0409 Version 2.0 --> "C:\Program Files\KnowNow\unins000.exe" Virtools 3D Life Player --> C:\Program Files\Virtools\3D Life Player\WebplayerConfig.exe -u VistaBootPRO 3.1 --> MsiExec.exe /I{909A54E2-CFFD-49EF-BD23-0ED2A1A76999} Windows Installer Clean Up --> MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52} Windows Live Anmelde-Assistent --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986} Windows Live Favorites für Windows Live Toolbar --> MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66} Windows Live installer --> MsiExec.exe /X{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6} Windows Live Messenger --> MsiExec.exe /X{2B091530-69AA-442E-AB09-39ED06B58220} Windows Live OneCare safety scanner --> "C:\Program Files\Windows Live Safety Center\UnInstall.exe" Windows Live OneCare safety scanner --> MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D} Windows Live Toolbar-Erweiterung (Windows Live Toolbar) --> MsiExec.exe /X{218761F6-CBF6-4973-B910-A33E6563A1EA} Windows Live Toolbar --> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0AC49543-9CE2-4434-AD42-5AA6E2967FA5} Windows Live Toolbar --> MsiExec.exe /X{0AC49543-9CE2-4434-AD42-5AA6E2967FA5} Windows Media Format 11 runtime --> "C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Player 11 --> "C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG Zattoo 3.1.1 Beta --> C:\Program Files\Zattoo\uninst.exe -- Application Event Log ------------------------------------------------------- Event Record #/Type50926 / Error Event Submitted/Written: 05/12/2008 01:41:32 PM Event ID/Source: 11706 / MsiInstaller Event Description: Product: SweetIM Toolbar for Internet Explorer 3.1 -- Error 1706.No valid source could be found for product SweetIM Toolbar for Internet Explorer 3.1. The Windows Installer cannot continue. Event Record #/Type50924 / Warning Event Submitted/Written: 05/12/2008 01:40:41 PM Event ID/Source: 1001 / MsiInstaller Event Description: Erkennung von Produkt "{59971D79-8111-42C2-9E40-883A0C277E78}" und Funktion "AlwaysInstall" fehlgeschlagen beim Anfordern von Komponente "{A177C793-ACB7-409C-96C7-E36C92DE33DE}". Event Record #/Type50923 / Warning Event Submitted/Written: 05/12/2008 01:40:41 PM Event ID/Source: 1004 / MsiInstaller Event Description: Erkennung von Produkt "{59971D79-8111-42C2-9E40-883A0C277E78}", Funktion "AlwaysInstall" und Komponente "{F9BE0D6D-9DBD-40C0-9DA2-E72709851FD0}" fehlgeschlagen. Die Ressource "C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" ist nicht vorhanden. Event Record #/Type50916 / Success Event Submitted/Written: 05/12/2008 00:22:16 PM Event ID/Source: 903 / Software Licensing Service Event Description: Der Softwarelizenzierungsdienst wurde angehalten. Event Record #/Type50910 / Error Event Submitted/Written: 05/12/2008 00:19:53 PM Event ID/Source: 11 / Microsoft-Windows-CAPI2 Event Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei. -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type175786 / Warning Event Submitted/Written: 05/12/2008 02:08:18 PM Event ID/Source: 3004 / WinDefend Event Description: Vom %ARJUNA27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %ARJUNA27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen. Weitere Informationen finden Sie im Folgenden: %ARJUNA275 Scan-ID: {FB39D1F3-1579-42F9-BD7C-83828D4B899B} Benutzer: ARJUNA\Gast Name: %ARJUNA271 ID: %ARJUNA272 Schweregrad-ID: %ARJUNA273 Kategorie-ID: %ARJUNA274 Gefundener Pfad: %ARJUNA276 Warnungsart: %ARJUNA278 Feststellungstyp: 1.1.1600.02 Event Record #/Type175785 / Warning Event Submitted/Written: 05/12/2008 02:08:18 PM Event ID/Source: 3004 / WinDefend Event Description: Vom %ARJUNA27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %ARJUNA27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen. Weitere Informationen finden Sie im Folgenden: %ARJUNA275 Scan-ID: {D950D33D-690E-4BBF-86BB-323C4D9C6F8C} Benutzer: ARJUNA\Gast Name: %ARJUNA271 ID: %ARJUNA272 Schweregrad-ID: %ARJUNA273 Kategorie-ID: %ARJUNA274 Gefundener Pfad: %ARJUNA276 Warnungsart: %ARJUNA278 Feststellungstyp: 1.1.1600.02 Event Record #/Type175784 / Warning Event Submitted/Written: 05/12/2008 02:08:17 PM Event ID/Source: 3004 / WinDefend Event Description: Vom %ARJUNA27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %ARJUNA27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen. Weitere Informationen finden Sie im Folgenden: %ARJUNA275 Scan-ID: {C9BC362F-D7D5-470E-B875-51659CDB11E1} Benutzer: ARJUNA\Gast Name: %ARJUNA271 ID: %ARJUNA272 Schweregrad-ID: %ARJUNA273 Kategorie-ID: %ARJUNA274 Gefundener Pfad: %ARJUNA276 Warnungsart: %ARJUNA278 Feststellungstyp: 1.1.1600.02 Event Record #/Type175783 / Warning Event Submitted/Written: 05/12/2008 02:08:17 PM Event ID/Source: 3004 / WinDefend Event Description: Vom %ARJUNA27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %ARJUNA27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen. Weitere Informationen finden Sie im Folgenden: %ARJUNA275 Scan-ID: {36134AFF-B111-470F-97AD-89E1FC894AE3} Benutzer: ARJUNA\Gast Name: %ARJUNA271 ID: %ARJUNA272 Schweregrad-ID: %ARJUNA273 Kategorie-ID: %ARJUNA274 Gefundener Pfad: %ARJUNA276 Warnungsart: %ARJUNA278 Feststellungstyp: 1.1.1600.02 Event Record #/Type175782 / Warning Event Submitted/Written: 05/12/2008 02:08:15 PM Event ID/Source: 3004 / WinDefend Event Description: Vom %ARJUNA27-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. %ARJUNA27 kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen. Weitere Informationen finden Sie im Folgenden: %ARJUNA275 Scan-ID: {C6D0F9B1-BAC0-43EC-990D-E8B5AA2FE8E8} Benutzer: ARJUNA\Gast Name: %ARJUNA271 ID: %ARJUNA272 Schweregrad-ID: %ARJUNA273 Kategorie-ID: %ARJUNA274 Gefundener Pfad: %ARJUNA276 Warnungsart: %ARJUNA278 Feststellungstyp: 1.1.1600.02 -- End of Deckard's System Scanner: finished at 2008-05-12 14:08:49 ------------ Anhang: main.txt
|
|
|
|
|
|
|
12.05.2008, 16:42
Ehrenmitglied
Beiträge: 29434 |
#6
Hallo,
0. Virustotal http://www.virustotal.com/flash/index_en.html c:\users\dean\appdata\local\qhdgenkic.exe Auf Durchsuchen klicken --> Datei aussuchen (oder gleich die Datei mit korrektem Pfad einkopieren mit Strg V) --> Klick auf die zu prüfende Datei und öffnen--> klick auf "Senden der Datei"... jetzt abwarten - dann mit der rechten Maustaste den Text markieren -> hier kopieren 1. deinstalliere: BearShare SweetIM for Messenger 2.5 SweetIM Toolbar for Internet Explorer 3.1 2. LOGONSERVER=\\ARJUNA - ist dir der Name ein Begriff ? 3. Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit "Speichern unter" auf dem Desktop. Gebe bei Dateityp "Alle Dateien" an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere hheir den Text, der erscheint Zitat cd\4.. scanne mit f-secure + poste den report http://virus-protect.org/onlinescan.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
12.05.2008, 22:10
...neu hier
Themenstarter Beiträge: 7 |
#7
Datei qhdgenkic.exe empfangen 2008.05.12 20:11:34 (CET)
Status: Beendet Ergebnis: 3/32 (9.38%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.5.10.0 2008.05.10 - AntiVir 7.8.0.17 2008.05.12 - Authentium 5.1.0.4 2008.05.11 - Avast 4.8.1169.0 2008.05.11 - AVG 7.5.0.516 2008.05.12 - BitDefender 7.2 2008.05.08 - CAT-QuickHeal 9.50 2008.05.12 (Suspicious) - DNAScan ClamAV 0.92.1 2008.05.12 - DrWeb 4.44.0.09170 2008.05.12 - eSafe 7.0.15.0 2008.05.12 - eTrust-Vet 31.4.5781 2008.05.12 - Ewido 4.0 2008.05.12 - F-Prot 4.4.2.54 2008.05.12 - F-Secure 6.70.13260.0 2008.05.12 - Fortinet 3.14.0.0 2008.05.12 - GData 2.0.7306.1023 2008.05.12 - Ikarus T3.1.1.26.0 2008.05.12 - Kaspersky 7.0.0.125 2008.05.12 - McAfee 5293 2008.05.12 - Microsoft 1.3408 2008.05.12 Trojan:Win32/Wintrim.gen!A NOD32v2 3093 2008.05.12 - Norman 5.80.02 2008.05.09 - Panda 9.0.0.4 2008.05.12 - Prevx1 V2 2008.05.12 Malicious Software Rising 20.44.02.00 2008.05.12 - Sophos 4.29.0 2008.05.12 - Sunbelt 3.0.1114.0 2008.05.12 - Symantec 10 2008.05.12 - TheHacker 6.2.92.307 2008.05.12 - VBA32 3.12.6.5 2008.05.12 - VirusBuster 4.3.26:9 2008.05.11 - Webwasher-Gateway 6.6.2 2008.05.12 - weitere Informationen File size: 319488 bytes MD5...: 782d69d216929f5799e242fd193906f5 SHA1..: 8ea134b8db507a0cf8f9f88090d0e1852c70c158 SHA256: cdf92fd9554f0688db300add574cd5dfd66f47aa8f5ae69208d6cee24a3e44e3 SHA512: 6c2733d86b7bc38950c78ae6c9369cfd53a13ff8ebf67b30bc9cd88b808c6d82 89fef9f8681a5c0f2f1ecadeed0330e24c68868588a575b985dbd8a8d7d7e6d1 PEiD..: Armadillo v1.71 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x449408 timedatestamp.....: 0x3f1ee672 (Wed Jul 23 19:48:02 2003) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x4859c 0x49000 7.99 9c556c0119a5f65bbcc77a99f8fed6ca .rdata 0x4a000 0x180e 0x2000 4.68 b95fcb64f7e3b823c453a9113a45f047 .data 0x4c000 0x11ac 0x2000 5.31 219cf4cc968d3077e14282b17f2101fe ( 12 imports ) > KERNEL32.dll: GetVersionExA, VirtualProtect, ConvertDefaultLocale, SetMailslotInfo, GetCurrentThread, FindFirstFileW, SetThreadPriorityBoost, FormatMessageA, lstrlenW, VirtualFree, ReadFile, GlobalFlags, PurgeComm, GetBinaryTypeA, IsBadWritePtr, SearchPathW, ScrollConsoleScreenBufferW, WriteTapemark, HeapSize, PeekConsoleInputA, GetFileAttributesExA, lstrcmpiA, GetStartupInfoW, CreateNamedPipeW, ReleaseMutex, SetProcessAffinityMask, GetTempPathA, GlobalFindAtomW, PeekConsoleInputW, SetConsoleCtrlHandler, GetThreadSelectorEntry, SetProcessShutdownParameters, ReadConsoleInputA, SetTapePosition, HeapCreate, SetConsoleTitleA, WriteProfileStringW, FreeEnvironmentStringsA, WriteProcessMemory, _llseek, SetConsoleWindowInfo, CallNamedPipeW, QueryPerformanceCounter, QueryDosDeviceA, InterlockedExchangeAdd, MoveFileA, MoveFileW, IsDBCSLeadByteEx, GetCommState, IsBadStringPtrW, WaitForSingleObjectEx, ExpandEnvironmentStringsA, LoadLibraryA, GetModuleHandleA, GetStartupInfoA > USER32.dll: VkKeyScanA, GetLastActivePopup, GetClassLongW, ScrollDC, BeginPaint, SystemParametersInfoA, EnumDesktopsA, GetScrollRange, LoadIconA, GetThreadDesktop, ActivateKeyboardLayout, GetGuiResources, ValidateRect, BroadcastSystemMessageA, InsertMenuItemW, GetClientRect, DrawFrameControl, RegisterDeviceNotificationW, wsprintfA, IsChild, EnumDesktopWindows, EnumWindowStationsW, DefFrameProcW, DestroyCursor, ScrollWindowEx, CopyAcceleratorTableW, GetScrollPos, SetScrollRange, WindowFromDC, SetWindowRgn, EndDialog, LoadImageA, OpenIcon, GetActiveWindow, CountClipboardFormats, SetWindowTextA, IsCharAlphaW, LoadBitmapW, OpenDesktopA, CloseWindowStation, MapDialogRect, RemovePropW, DestroyMenu, LoadMenuA, LoadAcceleratorsA, DrawIconEx, SendNotifyMessageW, GetMonitorInfoW > GDI32.dll: GetCurrentObject, CreateDCA, PlayEnhMetaFile, ResizePalette, SetWindowExtEx, SaveDC, SetBitmapBits, PtInRegion, GetOutlineTextMetricsA, AbortDoc, SwapBuffers, GetCharWidth32W, EnumFontFamiliesExA, CloseMetaFile, WidenPath, SetDIBColorTable, CopyEnhMetaFileW, StartDocA, GetNearestColor > comdlg32.dll: ReplaceTextA, PageSetupDlgW, PrintDlgW > ADVAPI32.dll: CryptImportKey, DeleteAce, LookupAccountSidW, LookupAccountNameW, RegRestoreKeyW, LockServiceDatabase, BuildSecurityDescriptorW, GetSecurityDescriptorLength, GetServiceDisplayNameA, AllocateAndInitializeSid, QueryServiceConfigA, CryptSetHashParam, RegQueryInfoKeyA, LookupAccountSidA, CryptCreateHash, QueryServiceStatus, RegQueryValueA, IsValidSecurityDescriptor, GetExplicitEntriesFromAclW, RegLoadKeyA, GetSecurityDescriptorControl, RegSetKeySecurity, AddAce, RegConnectRegistryA, RegEnumKeyA, RegDeleteValueW, CryptGetKeyParam, QueryServiceConfigW, NotifyBootConfigStatus, CreateProcessAsUserW, AdjustTokenPrivileges, CryptDeriveKey, GetSidSubAuthority > SHELL32.dll: ShellExecuteW, DragQueryFileW, SHFileOperationA > ole32.dll: ReadClassStm, OleTranslateAccelerator, OleLoadFromStream, OleCreateLinkFromData > OLEAUT32.dll: -, -, -, -, -, -, -, - > COMCTL32.dll: ImageList_GetImageCount > SHLWAPI.dll: PathGetDriveNumberA, PathIsRootW, PathRelativePathToA, StrChrIW, StrStrIA, AssocQueryStringW, PathCanonicalizeW, PathIsDirectoryA, SHRegQueryUSValueW, PathAddBackslashA, StrCmpLogicalW, PathIsNetworkPathW, StrCatBuffW, SHRegGetBoolUSValueA, PathRemoveArgsW, StrChrW, SHRegGetUSValueW, StrRChrA, PathCanonicalizeA > SETUPAPI.dll: SetupOpenAppendInfFileA, SetupLogErrorA, SetupDiGetClassDevsW, SetupDiGetINFClassA, SetupDiGetClassDevsExA, SetupDiDeleteDeviceInfo, SetupDiGetClassDevsA, SetupDiEnumDriverInfoW, SetupDiGetDriverInfoDetailW, SetupLogErrorW > MSVCRT.dll: _controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, strlen ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=9FA896550038D608E0A304E79BAA2D00989A9372 ACHTUNG: VirusTotal ist ein kostenloser Dienst bereitgestellt von Hispasec Sistemas. Es gibt keine Garantie zur Verfügbarkeit sowie Fortbestehen der Dienstleistung. Obwohl die Erkennungsrate meherer Antivirus-Engines besser ist als nur durch ein Produkt, garantieren die Ergebnisse des Scans nicht die Harmlosigkeit einer Datei. Gegenwärtig gibt es keine Lösung, welche eine Erkennungsrate aller Viren und Malware zu 100% bietet. VirusTotal © Hispasec Sistemas - Blog - Kontakt: info@virustotal.com Heir ist listen.bat Datentr„ger in Laufwerk C: ist 464321 Volumeseriennummer: B8DE-974F Verzeichnis von c:\users\dean\appdata\local 12.05.2008 09:27 <DIR> . 12.05.2008 09:27 <DIR> .. 26.06.2007 17:56 <DIR> 1Click DVD Copy 28.02.2007 15:33 <DIR> Adobe 19.03.2008 08:38 <DIR> Ahead 26.06.2007 14:24 <DIR> Apple 26.06.2007 14:27 <DIR> Apple Computer 03.09.2007 20:27 <DIR> ApplicationHistory 20.05.2007 20:39 <DIR> Apps 30.01.2008 22:35 <DIR> Canon Easy-PhotoPrint EX 05.05.2008 20:03 125'952 DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 22.05.2007 17:16 <DIR> EASportsOnline1 01.09.2007 08:54 92 fusioncache.dat 25.02.2008 11:37 106'536 GDIPFONTCACHEV1.DAT 02.02.2008 11:02 <DIR> Google 20.03.2007 21:06 <DIR> Help 28.02.2007 15:33 <DIR> Identities 21.04.2008 14:44 <DIR> Microsoft 01.03.2007 08:30 <DIR> Microsoft Games 23.10.2007 08:08 <DIR> Mozilla 18.03.2008 15:23 <DIR> Nero 12.05.2008 11:07 4'960 qhdgenkic.dat 05.05.2008 12:15 319'488 qhdgenkic.exe 08.05.2008 06:17 427'236 qhdgenkic_nav.dat 05.04.2008 13:36 811 qhdgenkic_navps.dat 29.01.2008 20:17 <DIR> Scansoft 04.09.2007 10:36 <DIR> Sony Ericsson 21.11.2007 15:49 <DIR> Stardock 28.02.2007 15:33 <DIR> Sun 12.05.2008 20:42 <DIR> Temp 16.01.2008 17:46 <DIR> VirtualStore 05.03.2007 07:25 <DIR> WindowsUpdate 08.01.2007 14:59 <DIR> WMTools Downloaded Files 15.01.2008 11:43 <DIR> Yahoo 11.05.2008 14:00 <DIR> Zattoo 28.10.2007 18:45 <DIR> ZattooPlayer 7 Datei(en), 985'075 Bytes 29 Verzeichnis(se), 116'017'364'992 Bytes frei Online Scan Scanning Report Monday, May 12, 2008 21:04:15 - 22:04:10 Computer name: ARJUNA Scanning type: Scan system for malware, rootkits Target: C:\ -------------------------------------------------------------------------------- Result: 2 malware found Tracking Cookie (spyware) System Trojan-Downloader.WMA.Wimad (virus) System -------------------------------------------------------------------------------- Statistics Scanned: Files: 38494 System: 5725 Not scanned: 83 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 None: 2 Submitted: 0 Files not scanned: `\H�IBERFIL.SYS C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{95C56BA1-12BC-4822-870F-0F2B8D9B1E3D}.BIN C:\USERS\DEAN\APPDATA\LOCAL\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{678FC315-0006-4688-9BB0-2CBDBED18B31} C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\00F61972FFD48C066D11055146B44168_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\08C8C56AECE03106CB3228E42B49ACDA_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\27A4BCB83B175737DE8F3CF1EC21DCB5_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\323D314BD695DD352518EA1A13826434_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4AA07B5499EB0044DED0C3E0E42849FC_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4F045EF444916C959DE10D1D5742A590_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\4FBAE01CE3DF58450B9267B082F6BD80_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\51C85227EAA19FEF15C08673B0BC9617_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\65954A046E5CE18C739B48AFAE6BE213_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\6654174ED12E19696A010D261598099C_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\669BB39460B410931EEEEF153FCF9D17_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\74BB7A2F61B38A8EB7FF940270475331_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7B114F48AB37ED0A0C5557FB8DF54689_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\7BAE9252EA0BC71F07358EBD02EBBC2A_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\80A7B35EA81B7EAF4E18A945B68A885F_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\8EFDB54714D160E26D3F8DD848CBD3CE_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\9575716BCDBE1BFA7D626D323AE5B94B_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\95BAC55D0CE2D55A9E302CF804A2D185_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\B8D2836B21B1D1DAF9EF1572B4893FF9_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DACE543E97C6C4A35DAEC98B1F24332E_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\DDE056BE230C38D3BD02EAD8519A6B09_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\F477D873D295EC6E56A86718297D5AAE_5962332D-43D4-44B6-85F1-632A31BD4487 C:\USERS\ALL USERS\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\FC1E3851F429EA606D6FF1E01A5A��2x C:\HIBERFIL.SYS C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT |
|
|
|
|
|
|
12.05.2008, 23:02
Ehrenmitglied
Beiträge: 29434 |
#8
Hallo,
1. wende navilog1 an + poste den report http://virus-protect.org/artikel/tools/navilog.html 2. http://virus-protect.org/artikel/tools/otmoveIt.html öffne: OTMoveIt.exe OTMoveIt Kopiere rein: im linken Fenster ,wo steht: Paste List of Files/Folders to Move Zitat c:\users\dean\appdata\local\qhdgenkic.datKlicke auf den Roten MoveIt! 3. berichte, ob die popups weg sind __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
13.05.2008, 07:29
...neu hier
Themenstarter Beiträge: 7 |
#9
Hi. Hier ist Navilog. Ich habe seit eine Stunde den Computer benutzed und die popups sind nicht mehr gekommen.Habe auch mit Erfolg otmoveIt Program durchgeführt.
ARJUNA ist den Name mein Sohn. Danke! Search Navipromo version 3.5.7 began on 13.05.2008 at 6:55:41.93 !!! Warning, this report may include legitimate files/programs !!! !!! Post this report on the forum you are being helped !!! !!! Don't continue with removal unless instructed by an authorized helper !!! Fix running from C:\Program Files\navilog1 Actual User Account : "Dean" Updated on 11.05.2008 at 18h00 by IL-MAFIOSO Microsoft Windows Vista 6.0.6001 Version Internet Explorer : 7.0.6001.18000 Filesystem type : NTFS Search done in normal mode *** Search folders in "C:\Windows" *** *** Search folders in "C:\Program Files" *** C:\Program Files\InternetGameBox found ! C:\Program Files\MessengerSkinner found ! *** Search folders in "C:\ProgramData" *** *** Search folders in "c:\progra~2\micros~1\windows\startm~1\programs" *** ...\InternetGameBox found ! ...\MessengerSkinner found ! *** Search folders in "c:\users\dean\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Search folders in "C:\Users\ADMINI~1\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Search folders in "C:\Users\Gast\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Search folders in "C:\Users\Dean\AppData\Local\virtualstore\Program Files" *** ...\InternetGameBox found ! *** Search folders in "C:\Users\Dean\AppData\Roaming" *** ...\MessengerSkinner found ! *** Search folders in "C:\Users\ADMINI~1\appdata\roaming" *** *** Search folders in "C:\Users\Gast\appdata\roaming" *** *** Search with Catchme-rootkit/stealth malware detector by gmer *** for more info : http://www.gmer.net No file found *** Search with GenericNaviSearch *** !!! Possibility of legitimate files in the result !!! !!! Must always be checked before manually deleting !!! * Scan in "C:\Windows\system32" * * Scan in "C:\Users\Dean\AppData\Local\Microsoft" * * Scan in "C:\Users\Dean\AppData\Local\virtualstore\windows\system32" * * Scan in "C:\Users\Dean\AppData\Local" * Files found : qhdgenkic.exe found ! qhdgenkic.dat found ! qhdgenkic_nav.dat found ! qhdgenkic_navps.dat found ! * Scan in "C:\Users\ADMINI~1\AppData\Local" * * Scan in "C:\Users\Gast\AppData\Local" * *** Search files *** c:\users\public\desktop\InternetGameBox.lnk found ! C:\Windows\system32\nvs2.inf found ! *** Search specific Registry keys *** HKEY_CURRENT_USER\Software\Lanconfig found ! *** Complementary Search *** (Search specific files) 1)Search new Instant Access files : 2)Heuristic Search : * In "C:\Windows\system32" : * In "C:\Users\Dean\AppData\Local\Microsoft" : * In "C:\Users\Dean\AppData\Local\virtualstore\windows\system32" : * In "C:\Users\Dean\AppData\Local" : qhdgenkic.dat found ! qhdgenkic_nav.dat found ! qhdgenkic_navps.dat found ! * In "C:\Users\ADMINI~1\AppData\Local" : * In "C:\Users\Gast\AppData\Local" : 3)Certificates Search : Egroup certificate found ! Electronic-Group certificate found ! OOO-Favorit certificate found ! Sunny-Day-Design-Ltd certificate not found ! 4)Search known files : *** Search completed on 13.05.2008 at 7:11:29.93 *** |
|
|
|
|
|
|
13.05.2008, 11:39
Ehrenmitglied
Beiträge: 29434 |
#10
Starte Navilog1 nochmal
öffne: Navilog1 Wähle: E und enter Im übernächsten Fenster schreibe: 2 - Automatic Cleaning Am Ende : Enter und es wird ein log erstellt (Fixnavi.txt) poste dessen Inhalt hier ins Forum __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
13.05.2008, 11:50
...neu hier
Themenstarter Beiträge: 7 |
#11
Hi. Hier ist Navilog
Navipromo Removal version 3.5.7 started on 13.05.2008 at 11:43:23.02 Fix running from C:\Program Files\navilog1 Actual User Account : "Dean" Updated on 11.05.2008 at 18h00 by IL-MAFIOSO Microsoft Windows Vista 6.0.6001 Internet Explorer : 7.0.6001.18000 Filesystem type : NTFS Automatic removal with Catchme and GNS results Cleanning stage done on Reboot *** fsbl1.txt not found *** (Check that Catchme found nothing in Search Mode) *** Deleting with Backups GenericNaviSearch results *** * Deletion in "C:\Windows\System32" * * Deletion in "C:\Users\Dean\AppData\Local\Microsoft" * * Deletion in "C:\Users\Dean\AppData\Local\virtualstore\windows\system32" * * Deletion in "C:\Users\Dean\AppData\Local" * * Deletion in "C:\Users\ADMINI~1\AppData\Local" * * Deletion in "C:\Users\Gast\AppData\Local" * *** Deleting folders in "C:\Windows" *** *** Deleting folders in "C:\Program Files" *** C:\Program Files\InternetGamebox ...deleting... C:\Program Files\InternetGamebox deleted ! C:\Program Files\MessengerSkinner ...deleting... C:\Program Files\MessengerSkinner deleted ! *** Deleting folders in "C:\ProgramData" *** *** Deleting folders in "c:\progra~2\micros~1\windows\startm~1\programs" *** ...\InternetGamebox ...deleting... ...\InternetGamebox deleted ! ...\MessengerSkinner ...deleting... ...\MessengerSkinner deleted ! *** Deleting folders in c:\users\dean\appdata\roaming\micros~1\windows\startm~1\programs *** *** Deleting folders in "C:\Users\ADMINI~1\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Deleting folders in "C:\Users\Gast\appdata\roaming\micros~1\windows\startm~1\programs" *** *** Deleting folders in "C:\Users\Dean\AppData\Local\virtualstore\Program Files" *** ...\InternetGamebox ...deleting... ...\InternetGamebox deleted ! *** Deleting folders in "C:\Users\Dean\AppData\Roaming" *** ...\MessengerSkinner ...deleting... ...\MessengerSkinner deleted ! *** Deleting folders in "C:\Users\ADMINI~1\appdata\roaming" *** *** Deleting folders in "C:\Users\Gast\appdata\roaming" *** *** Deleting files *** c:\users\public\desktop\InternetGameBox.lnk deleted ! C:\Windows\system32\nvs2.inf deleted ! *** Deleting temporary files *** Cleaning of C:\Windows\Temp done ! Cleaning of C:\Users\Dean\AppData\Local\Temp done ! *** Complementary Search *** (Search specific files) 1)Deletion with backups new Instant Access files: 2)Heuristic search and deletion with backups : * In "C:\Windows\system32" * * In "C:\Users\Dean\AppData\Local\Microsoft" * * In "C:\Users\Dean\AppData\Local\virtualstore\windows\system32" * * In "C:\Users\Dean\AppData\Local" * * In "C:\Users\ADMINI~1\AppData\Local" * * In "C:\Users\Gast\AppData\Local" * *** Copy Registry to Safebackup folder *** Backing up Registry done ! *** Cleaning Registry *** Registry cleaned *** Certificates *** Egroup Certificate deleted ! Electronic-Group Certificate deleted ! OOO-Favorit Certificate deleted ! Sunny-Day-Design-Ltd Certificate not found ! *** Cleaning stage complete on 13.05.2008 at 11:46:51.74 *** |
|
|
|
|
|
|
13.05.2008, 12:14
Ehrenmitglied
Beiträge: 29434 |
#12
Hallo keithdean
« entferne C:\Program Files\navilog1 wieder vom PC. « OTMoveIt klicken: CleanUp! button cleanup.txt wird vom Internet geladen (von Firewall zulassen!) Begin cleanup process? klicke: Yes. - "Do you want to reboot?" klicke Yes « dann sollte wieder alles im grünen Bereich sein  __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
13.05.2008, 13:38
...neu hier
Themenstarter Beiträge: 7 |
||
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
- » CPU-Belastung durch Forensoftware
- » Welche Internet Security bietet schnellen und guten Internet/Port 80 Schutz?
- » Suche Internet Terminal / Site Kiosk bzw. Internet Cafe Software
- » Mc Afee Internet Security Suite 2006 + Internet Explorer Problem
- » Norton Internet Security, automatisches Update wenn PC mit Internet verbunden
Seite(n): 1
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Ich habe keine Lösung gefunden. Könnten sie mir helfen.
Danke
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:49:51, on 10.05.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\system32\taskeng.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\****\AppData\Local\qhdgenkic.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger .exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Windows\System32\mobsync.exe
C:\Users\****\Desktop\HiJackThis.exe
C:\Windows\system32\SearchFilterHost.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://search.bearshare.com/ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = h**p://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\4516\toolbaru.dll
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O1 - Hosts: ::1 localhost
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\4516\toolbaru.dll
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: UrlHelper Class - {6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\4516\toolbaru.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [qhdgenkic] c:\users\dean\appdata\local\qhdgenkic.exe qhdgenkic
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: AutorunsDisabled
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger .exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - h**p://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O13 - Gopher Prefix:
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.7.801.1629 (GoogleDesktopManager-010108-205858) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (file missing)
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIb\RpcSandraSrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
--
End of file - 10698 bytes