hi
habe vor kurzen hier gepostet
jemand den ich kenne hat auch probleme mit den rechner
und bazokkaCode:Logfile of HijackThis v1.99.0 Scan saved at 21:11:18, on 22.02.2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\Explorer.EXE C:\Programme\QuickTime\qttask.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\Winamp\Winampa.exe C:\WINDOWS\Mixer.exe C:\WINDOWS\System32\ctfmon.exe C:\Programme\Netscape\Netscape\Netscp.exe C:\WINDOWS\System32\Msshll.exe C:\WINDOWS\System32\Scnex.exe C:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Programme\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://www.new-search.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.new-search.info/search.html R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://www.new-search.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.new-search.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://0ml.net/searchasst.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://0ml.net/cat R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0ml.net/cat R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://0ml.net/cat R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://0ml.net/cat R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINDOWS\_s.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://0ml.net/searchasst.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://0ml.net/cat R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://0ml.net/cat R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://0ml.net/searchasst.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.new-search.info/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = C:\WINDOWS\_sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://0ml.net/searchasst.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.new-search.info/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = C:\WINDOWS\_sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_hp.html R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = C:\WINDOWS\_hp.html R3 - URLSearchHook: (no name) - {4C41BD0D-3CE6-423B-8957-818524394C10} - C:\WINDOWS\System32\Q361015.dll (file missing) R3 - URLSearchHook: Richfind - {F377AF60-A4E9-4697-A6AB-0725E7C4B303} - C:\WINDOWS\System32\Q361015.dll (file missing) O1 - Hosts: lala.com 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {28929718-A6C6-4B2A-84BC-9A699B8DD72B} - C:\WINDOWS\System32\Q361015.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {9EC953B3-58C6-4BAA-A677-7E86D5B853C5} - C:\WINDOWS\System32\badlfk.dll (file missing) O2 - BHO: IEHlprObj Class - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\System32\f98er24s8u.dll O3 - Toolbar: (no name) - {BC6895ED-149D-44FF-919D-706B5E788F3B} - C:\WINDOWS\System32\Q361015.dll (file missing) O3 - Toolbar: Richfind - {0E592E01-F96B-41F5-AA89-550AEBCED501} - C:\WINDOWS\System32\Q361015.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Comm Driver] C:\WINDOWS\System32\Commh32.exe O4 - HKLM\..\Run: [ODBC BackUp] C:\WINDOWS\Inf\Oxpll.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Microsoft DirectX] wuamgrd.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [WinampAgent] "C:\Programme\Winamp\Winampa.exe" O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\RunServices: [Microsoft DirectX] wuamgrd.exe O4 - HKLM\..\RunServices: [SysPilot] C:\WINDOWS\System32\Fdxxl.exe O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Programme\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [ODBC BackUp] C:\WINDOWS\System32\Fdxxl.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Programme\Netscape\Netscape\Netscp.exe" -turbo O4 - HKCU\..\Run: [Civ3GoldSetup.exe] C:\DOKUME~1\ivica\Desktop\CIV3GO~1.EXE /r O4 - HKCU\..\Run: [D2ProphecySetup.exe] C:\DOKUME~1\ivica\Desktop\D2PROP~1.EXE /r O4 - HKCU\..\Run: [CivilizationIIIGoldSetup.exe] C:\DOKUME~1\ivica\Desktop\CIVILI~1.EXE /r O4 - Startup: PowerReg Scheduler V3.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Richfind - {0E592E01-F96B-41F5-AA89-550AEBCED501} - C:\WINDOWS\System32\Q361015.dll (file missing) O9 - Extra button: (no name) - {BC6895ED-149D-44FF-919D-706B5E788F3B} - C:\WINDOWS\System32\Q361015.dll (file missing) O9 - Extra button: Weight+Loss - - http://new-search.info/s.php?qq=Weight+Loss (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Weight+Loss - - http://new-search.info/s.php?qq=Weight+Loss (file missing) (HKCU) O9 - Extra button: *** Pictures - {0234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/***.html (file missing) (HKCU) O9 - Extra 'Tools' menuitem: *** Pictures - {0234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/***.html (file missing) (HKCU) O9 - Extra button: Craps Online Tour - {1234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Craps (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Craps Online Tour - {1234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Craps (file missing) (HKCU) O9 - Extra button: Online Pharmacy 24h - {2234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Online+Pharmacy (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Online Pharmacy 24h - {2234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Online+Pharmacy (file missing) (HKCU) O9 - Extra button: Remover Spyware - {3234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Spyware (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Remover Spyware - {3234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Spyware (file missing) (HKCU) O9 - Extra button: Cash Advance - {4234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Cash+Advance (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Cash Advance - {4234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Cash+Advance (file missing) (HKCU) O9 - Extra button: New Strip Poker - {6234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Poker (file missing) (HKCU) O9 - Extra 'Tools' menuitem: New Strip Poker - {6234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Poker (file missing) (HKCU) O9 - Extra button: Free Viagra Video - {7234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Viagra (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Free Viagra Video - {7234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Viagra (file missing) (HKCU) O9 - Extra button: *** Drug Soma - {8234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Soma (file missing) (HKCU) O9 - Extra 'Tools' menuitem: *** Drug Soma - {8234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Soma (file missing) (HKCU) O9 - Extra button: Hair Loss - {9234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Hire+Loss (file missing) (HKCU) O9 - Extra 'Tools' menuitem: Hair Loss - {9234f700-cba3-4071-b251-47cb894244cd} - http://new-search.info/s.php?qq=Hire+Loss (file missing) (HKCU) O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
sieht übel aus oder?Code:Bazooka Scanner v1.13.02 http://www.kephyr.com/spywarescanner/ http://www.kephyr.com/spywarescanner/library/ support@kephyr.com Log created 21:13:47. OS: Windows NT 5.1 Database version: 2.220000 Database format version: 1.020000 Database date: 20040806 Current date: 2005-02-22 21:13 **************************************** Result when scanning: MS Media Player GUID 404.888.000 HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\Settings\Client ID http://www.kephyr.com/spywarescanner/library/msmediaplayerguid/index.phtml ShopNav 692.218.240 {CE7C3CF0-4B15-11D1-ABED-709549C10000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000} http://www.kephyr.com/spywarescanner/library/shopnav/index.phtml **************************************** Auto start entries: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l C:\Dokumente und Einstellungen\ivica\Startmenü\Programme\Autostart\desktop.ini C:\Dokumente und Einstellungen\ivica\Startmenü\Programme\Autostart\PowerReg Scheduler V3.exe C:\Dokumente und Einstellungen\ivica\Startmenü\Programme\Autostart\desktop.ini C:\Dokumente und Einstellungen\ivica\Startmenü\Programme\Autostart\PowerReg Scheduler V3.exe Go here to analyse the startup entries and the associated files: http://www.kephyr.com/filedb/index.php **************************************** Run entries: Comm Driver C:\WINDOWS\System32\Commh32.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Comm Driver ODBC BackUp C:\WINDOWS\Inf\Oxpll.exe HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ODBC BackUp QuickTime Task "C:\Programme\QuickTime\qttask.exe" -atboottime HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\QuickTime Task nwiz nwiz.exe /install
