ständige Browserpopups

[Unregistriert-Drag]

Hi, bei mir öffnet sich aller 5 Minuten der Browser mit irgendwelcher Werbung, von der ich dann gleich nen Link auf meinem Desktop habe...

Hier mal mein Hijackthis logfile:



Logfile of HijackThis v1.99.1
Scan saved at 01:18:23, on 23.04.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
C:\Programme\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\Winamp5\Winamp\winampa.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Picasa2\PicasaMediaDetector.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\ASUS\ASUS FM Radio\ezagent.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\AOL 9.0a\aoltray.exe
C:\Programme\AOL 9.0a\waol.exe
C:\Programme\AOL 9.0a\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\WINDOWS\system32\calc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\AOL 9.0a\download\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,oebydcs.exe
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Programme\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
O4 - HKLM\..\Run: [IW_ControlCenter] C:\Programme\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp5\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard11.exe
O4 - HKLM\..\Run: [mqhisu] C:\WINDOWS\system32\nadqsw.exe reg_run
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [EzAgent] C:\Programme\ASUS\ASUS FM Radio\ezagent.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [jnojt] C:\WINDOWS\system32\nadqsw.exe reg_run
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0a\aoltray.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {662DF779-648D-4692-AB1E-3EF57B376EF7} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {662DF779-648D-4692-AB1E-3EF57B376EF7} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O16 - DPF: Dice Derby by pogo - http://game.pogo.com/applet-5.8.3.20...-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game4.pogo.com/applet-6.1.2.3...-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game4.pogo.com/applet-6.1.1.2...-ob-assets.cab
O16 - DPF: Phlinx by pogo - http://game4.pogo.com/applet-6.1.2.2...-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://game4.pogo.com/applet-5.8.6.2...-ob-assets.cab
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab
O16 - DPF: Squelchies by pogo - http://game4.pogo.com/applet-6.1.2.3...-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game4.pogo.com/applet-6.1.1.2...-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game5.pogo.com/applet-5.9.5.3...-ob-assets.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.de/common/asusTek_sys_ctrl.cab
O16 - DPF: {13B03B06-C0DF-4522-BDBA-E0B2365C72A5} (Flatcast Viewer 4.7) - http://www.interactiv-plus.de/flatcast/NpFv47.dll
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/zenpuzzlegar...GameLoader.dll
O16 - DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F7} (Flatcast Viewer 4.10) - http://www.1mal1.com/flatcast/NpFv410.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.de/computercheckup/qdiagcc.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://arcade.icq.com/multiplayer/odyssey_web8.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylomgames.com/activex...amesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game12.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5E234A5-9CA2-4E77-85A2-FE29A53F3D44}: NameServer = 205.188.146.145
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\c0000admed0a0.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Hoffe ihr könnt mir weiterhelfen...

MfG DraG

[Speedy]

hi, schaun wir mal

diese datei(en) hier bei virustotal oder bei Jotti überprüfen lassen, ergebnis (egal wie es aussieht) posten.

oebydcs. exe

downlaod den ccleaner, installieren, starten -> unter options settings -> german einstellen, weiters unter einstellungen erweitert folgendes deaktiveren --> mehr als 48h alte..... ! nun bereinige mit dem ccleaner dein system (windows, applications, registry) (quick-tour und screenshots), die temp. ordner überprüfen, notfalls im abgesicherten modus leeren, mistküble leeren

bitte lade die look2me-destroyer.exe herunter und speichere sie auf deinem desktop.

* schliesse alle anwendungen bevor du weitermachst.
* mach einen doppelklick auf die look2me-destroyer.exe, um sie zu starten.
* setze ein häkchen neben 'Run this program as a task' (lass das programm laufen).
* du wirst einen bericht erhalten, der besagt 'look2me-destroyer will close and re-open in approximately 10 seconds' (der look2me-destroyer wird sich in ungefähr 10 Sekunden schliessen und wieder öffnen). klicke auf ok
* wenn sich der look2me-destroyer wieder öffnet, klicke auf den scan für l2m button, deine desktop iconen werden verschwinden, das ist normal.
* wenn der scan zuende ist, klicke auf den 'remove l2m' button (entferne l2m button).
* du wirst nun einen 'done scanning'(scan ist erledigt) bericht erhalten, klicke ok.
* wenn alles beendet ist, wirst du diesen bericht erhalten: 'done removing infected files! look2me-destroyer will now shutdown your computer' (die infizierten files sind entfernt. der look2me-destroyer wird deinen rechner nun herunterfahren). klicke ok.
* dein rechner wird nun ausgeschaltet.
* stelle deinen computer wieder an.
* bitte kopiere und poste den inhalt des C:\look2me-destroyer.txt logfiles.

für den fall, dass du einen bericht deiner firewall bekommst, dass dieses programm versucht, auf das internet zuzugreifen, erlaube es bitte.

falls du einen runtime error '339' erhältst, lade bitte die MSWINSCK.OCX herunter und gib sie in deinen C:\Windows\System32 ordner.


verwende den smitfraudfix remover nach dieser anleitung (und download), poste nach jedem scan das logfile

downlaod von datfindbat, führe es nach anleitung aus und poste den inhalt der erstellten logfiles (das werden 4 stück, wobei von c:\windows\system32 nur die letzten 30 tage gepostet werden sollten)

+ ein aktuelles hjt-logfile

[Unregistriert-Drag]

das virustotal war kein problem, bericht hier:

STATUS: FINISHEDComplete scanning result of "oebydcs._exe", received in VirusTotal at 04.23.2006, 02:16:40 (CET).

Antivirus Version Update Result
AntiVir 6.34.0.24 04.20.2006 no virus found
Avast 4.6.695.0 04.21.2006 no virus found
AVG 386 04.22.2006 no virus found
Avira 6.34.0.56 04.22.2006 no virus found
BitDefender 7.2 04.23.2006 no virus found
CAT-QuickHeal 8.00 04.21.2006 no virus found
ClamAV devel-20060202 04.23.2006 no virus found
DrWeb 4.33 04.22.2006 no virus found
eTrust-InoculateIT 23.71.136 04.22.2006 no virus found
eTrust-Vet 12.4.2171 04.21.2006 no virus found
Ewido 3.5 04.22.2006 no virus found
Fortinet 2.71.0.0 04.23.2006 no virus found
F-Prot 3.16c 04.21.2006 no virus found
Ikarus 0.2.59.0 04.21.2006 no virus found
Kaspersky 4.0.2.24 04.23.2006 no virus found
McAfee 4746 04.21.2006 no virus found
NOD32v2 1.1502 04.22.2006 no virus found
Norman 5.90.16 04.21.2006 no virus found
Panda 9.0.0.4 04.22.2006 no virus found
Sophos 4.04.0 04.22.2006 no virus found
Symantec 8.0 04.23.2006 no virus found
TheHacker 5.9.7.133 04.22.2006 no virus found
UNA 1.83 04.21.2006 no virus found
VBA32 3.11.0 04.22.2006 no virus found


Aditional Information
File size: 0 bytes
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709



der look2me-destroyer funktioniert nicht... keine ahnung wieso nich... hab auf desktop gespeichert, hatte alle anwendugnen unten, programm hat gestartet, dann habe ich das häckchen gesetzt, die meldung kam (allerdings mit dem hinweis das es ungefähr 1 Minute dauern wird)
ab hier geht dann nichts mehr 5 minuten später kam immer noch nix
Wieso läuft das nicht an oO?



smitfraudfix remover habe ich noch nicht probiert, und datfindbat auch noch nich probiert, mache ich dann morgen.... jez lege ich mich erstmalschlafen... morgen/heute mehr...
schonmal thx für die hilfebemühungen

MfG Drag

[Speedy]

hi

bitte dann zuerst smitfraufix ausführen, dann nocheinmal den look2me destroyer versuchen, funzt das wieder nicht, dann download den look2me-remover von SimplyTech. führe in nach anleitung aus, poste das logfile

der rest ist wie gehabt

[Unregistriert-Drag]

Hi,
nachdem ich smitfraudfix ausgeführt habe ging dann auch das L2M.
Hier das L2M-logfile (komplett):

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 23.04.2006 16:02:09

Infected! C:\WINDOWS\system32\l8l60i3se8.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252550.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252551.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252552.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252553.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252554.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252555.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252575.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252602.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252622.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252645.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252666.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252674.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP295\A0253693.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253725.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253746.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253774.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253794.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253797.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253820.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253827.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253848.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253907.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253929.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253955.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253968.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253988.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253999.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254019.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254045.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254054.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254075.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254082.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254131.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254152.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256131.dll
Infected! C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256154.dll
Infected! C:\WINDOWS\system32\enjml1111.dll
Infected! C:\WINDOWS\system32\g2402chmgf4a2.dll
Infected! C:\WINDOWS\system32\g4lmle311h.dll
Infected! C:\WINDOWS\system32\inagehlp.dll
Infected! C:\WINDOWS\system32\kt06l7ds1.dll
Infected! C:\WINDOWS\system32\kvdno.dll
Infected! C:\WINDOWS\system32\l2p20c7oef.dll
Infected! C:\WINDOWS\system32\l8l60i3se8.dll
Infected! C:\WINDOWS\system32\mcgina.dll
Infected! C:\WINDOWS\system32\o484lelq1hqe.dll
Infected! C:\WINDOWS\system32\q4680ejueho80.dll
Infected! C:\WINDOWS\system32\r88slil718q.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\l8l60i3se8.dll
C:\WINDOWS\system32\l8l60i3se8.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252550.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252550.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252551.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252551.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252552.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252552.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252553.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252553.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252554.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252554.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252555.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252555.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252575.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252575.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252602.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252602.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252622.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252622.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252645.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252645.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252666.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252666.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252674.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP293\A0252674.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP295\A0253693.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP295\A0253693.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253725.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253725.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253746.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP299\A0253746.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253774.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253774.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253794.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253794.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253797.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253797.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253820.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253820.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253827.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253827.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253848.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253848.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253907.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253907.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253929.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253929.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253955.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253955.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253968.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253968.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253988.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253988.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253999.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0253999.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254019.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254019.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254045.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254045.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254054.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254054.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254075.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254075.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254082.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254082.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254131.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254131.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254152.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0254152.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256131.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256131.dll Deleted successfully!

Attempting to delete: C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256154.dll
C:\System Volume Information\_restore{91DF1FC5-53C7-4E4C-860E-5DFF1FC2A6D8}\RP301\A0256154.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\enjml1111.dll
C:\WINDOWS\system32\enjml1111.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\g2402chmgf4a2.dll
C:\WINDOWS\system32\g2402chmgf4a2.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\g4lmle311h.dll
C:\WINDOWS\system32\g4lmle311h.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\inagehlp.dll
C:\WINDOWS\system32\inagehlp.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kt06l7ds1.dll
C:\WINDOWS\system32\kt06l7ds1.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\kvdno.dll
C:\WINDOWS\system32\kvdno.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\l2p20c7oef.dll
C:\WINDOWS\system32\l2p20c7oef.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\l8l60i3se8.dll
C:\WINDOWS\system32\l8l60i3se8.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\mcgina.dll
C:\WINDOWS\system32\mcgina.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\o484lelq1hqe.dll
C:\WINDOWS\system32\o484lelq1hqe.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\q4680ejueho80.dll
C:\WINDOWS\system32\q4680ejueho80.dll Deleted successfully!

Attempting to delete: C:\WINDOWS\system32\r88slil718q.dll
C:\WINDOWS\system32\r88slil718q.dll Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\StillImage

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{338674D8-DE16-4A64-BCC1-32D15D73B56B}"
HKCR\Clsid\{338674D8-DE16-4A64-BCC1-32D15D73B56B}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3C897BB3-6BAF-4DAB-8E0C-386394A6C050}"
HKCR\Clsid\{3C897BB3-6BAF-4DAB-8E0C-386394A6C050}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administratoren - Succeeded



so, jez noch das datFind.bat-logfile:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 8840-E806

Verzeichnis von C:\WINDOWS\system32

23.04.2006 16:09 42.822 nvapps.xml
21.04.2006 21:35 4.212 zllictbl.dat
20.04.2006 19:13 1.158 wpa.dbl
17.04.2006 02:34 8.464 sporder.dll
26.03.2006 12:40 380.350 perfh009.dat
26.03.2006 12:40 391.000 perfh007.dat
26.03.2006 12:40 52.764 perfc009.dat
26.03.2006 12:40 63.580 perfc007.dat
26.03.2006 12:40 897.778 PerfStringBackup.INI
21.03.2006 21:10 6.948 jupdate-1.5.0_06-b05.log
21.03.2006 17:41 3.776 OEMINFO.PNF
16.03.2006 11:34 71.448 zlcommdb.dll
16.03.2006 11:34 79.640 zlcomm.dll
16.03.2006 11:33 100.120 vsxml.dll
16.03.2006 11:33 382.744 vsutil.dll
16.03.2006 11:33 71.448 vsregexp.dll
16.03.2006 11:33 227.096 vspubapi.dll
16.03.2006 11:33 104.216 vsmonapi.dll
16.03.2006 11:33 141.080 vsinit.dll
16.03.2006 11:33 372.824 vsdatant.sys
16.03.2006 11:32 83.736 vsdata.dll
10.02.2006 11:43 287.170 SrchSTS.exe
18.01.2006 14:05 57.344 avsda.dll
09.01.2006 10:36 40.960 swsc.exe
09.01.2006 10:36 42.496 swreg.exe


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 8840-E806

Verzeichnis von C:\DOKUME~1\BHM~1\LOKALE~1\Temp

23.04.2006 16:11 4 PMShared
23.04.2006 16:05 206 jusched.log
01.01.1970 02:00 2.167 qenvyynt.ABI
3 Datei(en) 2.377 Bytes
0 Verzeichnis(se), 83.521.904.640 Bytes frei


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 8840-E806

Verzeichnis von C:\WINDOWS

23.04.2006 16:10 1.187 win.ini
23.04.2006 16:10 0 0.log
23.04.2006 16:09 252 wiadebug.log
23.04.2006 16:09 1.033.242 WindowsUpdate.log
23.04.2006 16:09 50 wiaservc.log
23.04.2006 16:09 800 SchedLgU.Txt
23.04.2006 16:09 2.048 bootstat.dat
23.04.2006 15:52 127.730 ntbtlog.txt
23.04.2006 15:52 120 setupact.log
23.04.2006 15:49 0 setuperr.log
22.04.2006 13:18 4.116 ModemLog_FM-56PCI-HSFi-AB.txt
21.04.2006 23:09 1.125 Winamp.ini
21.04.2006 21:23 105 clientshell.INI
17.04.2006 19:20 350 lujxj.dll
17.04.2006 02:34 53 bbwlel.dat
17.04.2006 02:33 0 keyboard111.dat
17.04.2006 02:33 0 newname.dat
17.04.2006 02:33 24.576 keyboard11.exe
21.03.2006 17:27 725 aolback.exe.lnk
21.03.2006 17:26 316.640 WMSysPr9.prx
16.03.2006 21:07 107.134 UninstallFirefox.exe
16.03.2006 21:07 13.111 mozver.dat
07.02.2006 23:17 3.429 Ascd_tmp.ini
17.01.2006 22:49 256 system.ini


Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 8840-E806

Verzeichnis von C:\

23.04.2006 16:15 0 sys.txt
23.04.2006 16:14 8.405 system.txt
23.04.2006 16:13 388 systemtemp.txt
23.04.2006 16:12 113.648 system32.txt
23.04.2006 16:09 805.306.368 pagefile.sys
23.04.2006 15:52 462 rapport.txt




Und hier noch ein aktuelles Hijackthis-logfile:

Logfile of HijackThis v1.99.1
Scan saved at 16:17:57, on 23.04.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
C:\Programme\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\Winamp5\Winamp\winampa.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Picasa2\PicasaMediaDetector.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\ASUS\ASUS FM Radio\ezagent.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\AOL 9.0a\aoltray.exe
C:\Programme\AOL 9.0a\waol.exe
C:\Programme\AOL 9.0a\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\Programme\Windows NT\Zubehör\WORDPAD.EXE
C:\Programme\AOL 9.0a\download\hijackthis\HijackThis.exe

R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,oebydcs.exe
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Programme\MultiMedia Keyboard\MultiMedia Keyboard\1.1\KbdAp32A.exe
O4 - HKLM\..\Run: [IW_ControlCenter] C:\Programme\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp5\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programme\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [mqhisu] C:\WINDOWS\system32\nadqsw.exe reg_run
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [EzAgent] C:\Programme\ASUS\ASUS FM Radio\ezagent.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [jnojt] C:\WINDOWS\system32\nadqsw.exe reg_run
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0a\aoltray.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {662DF779-648D-4692-AB1E-3EF57B376EF7} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {662DF779-648D-4692-AB1E-3EF57B376EF7} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O16 - DPF: Dice Derby by pogo - http://game.pogo.com/applet-5.8.3.20...-ob-assets.cab
O16 - DPF: Fortune Bingo by pogo - http://game4.pogo.com/applet-6.1.2.3...-ob-assets.cab
O16 - DPF: Mah Jong Garden by pogo - http://game4.pogo.com/applet-6.1.1.2...-ob-assets.cab
O16 - DPF: Phlinx by pogo - http://game4.pogo.com/applet-6.1.2.2...-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://game4.pogo.com/applet-5.8.6.2...-ob-assets.cab
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/...gameloader.cab
O16 - DPF: Squelchies by pogo - http://game4.pogo.com/applet-6.1.2.3...-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game4.pogo.com/applet-6.1.1.2...-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://game5.pogo.com/applet-5.9.5.3...-ob-assets.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.de/common/asusTek_sys_ctrl.cab
O16 - DPF: {13B03B06-C0DF-4522-BDBA-E0B2365C72A5} (Flatcast Viewer 4.7) - http://www.interactiv-plus.de/flatcast/NpFv47.dll
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/bestfriends/retro64_loader.dll
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/zenpuzzlegar...GameLoader.dll
O16 - DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F7} (Flatcast Viewer 4.10) - http://www.1mal1.com/flatcast/NpFv410.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.de/computercheckup/qdiagcc.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://arcade.icq.com/multiplayer/odyssey_web8.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game11.zylomgames.com/activex...amesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game12.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite...ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5E234A5-9CA2-4E77-85A2-FE29A53F3D44}: NameServer = 205.188.146.145
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe



Ich hoffe das war jetzt nicht zu viel was ich gepostet habe ^^



PS: Es scheint so als ob kein Browserpopup mehr da is, zumindest kam in den letzten ca. 7Minuten keins ^^


Danke

MfG DraG

[Speedy]

hi

bitte die angeführten dateien in den ordner c:\boese verschieben (kopieren) und an diese adressen gezippt hochladen
anleitung (winxp) zum packen von dateien und wie man das zip-file mit passwortschutz versendet. (bitte den link, hier zu diesen beitrag, ebenfalls hinzufügen)

• a-squared
• siri

C:\WINDOWS

17.04.2006 19:20 350 lujxj.dll
17.04.2006 02:34 53 bbwlel.dat
17.04.2006 02:33 0 keyboard111.dat
17.04.2006 02:33 0 newname.dat
17.04.2006 02:33 24.576 keyboard11.exe


diese datei(en) hier bei virustotal oder bei Jotti überprüfen lassen, ergebnis (egal wie es aussieht) posten.
C:\WINDOWS

17.04.2006 19:20 350 lujxj.dll
17.04.2006 02:34 53 bbwlel.dat