Seid gegrüßt!
ich hatte die Tage ein paar Problemchen mit 2 Trojanern und etwas Spyware...
Hab sie jetzt hoffentlich entfernen können. Um auf Nummer sicher zu gehen wollte ich noch eure Meinung zu meinem Logfile hören. Schonmal ein dickes Dankeschön in vorraus!!!
Code:Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:43:15, on 25.12.2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programme\Internet\Sygate Firewall\smc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe E:\Programme\Internet\Ad-Aware\aawservice.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Java\jre1.5.0_06\bin\jusched.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\LVCOMSX.EXE E:\Programme\Internet\Norten AntiBot\agent\Bin\NABAgent.exe E:\Programme\Internet\Webcam\LogiTray.exe E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe E:\Programme\Internet\ThreatFire\TFTray.exe E:\Programme\Internet\Norten AntiBot\agent\bin\NortonAntiBot.exe E:\Programme\Internet\Acronis True Image\TrueImageMonitor.exe E:\Programme\Internet\Acronis True Image\TimounterMonitor.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe E:\Programme\Internet\a-squared Anti-Dialer\a2adguard.exe E:\Programme\Internet\Spybot\TeaTimer.exe E:\Programme\Anderes\Logitech\SetPoint\SetPoint.exe C:\Programme\T-COM\T-COM WLAN Manager T-Sinus 154data\Installer\WINXP\DTUSB11GMonitor.exe E:\Programme\Anderes\Mousometer\mousometer.exe C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE E:\Programme\Internet\Webcam\FxSvr2.exe E:\Programme\Internet\0190 Warner\w0svc.exe E:\Programme\Internet\a-squared Anti-Dialer\a2service.exe C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\sched.exe E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\avguard.exe E:\Programme\Internet\Registry Mechanic\SbieSvc.exe C:\WINDOWS\System32\svchost.exe E:\Programme\Internet\Norten AntiBot\agent\Bin\NABWatcher.exe E:\Programme\Internet\ThreatFire\TFService.exe C:\WINDOWS\system32\wdfmgr.exe E:\Programme\Internet\Norten AntiBot\agent\bin\NABMonitor.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe E:\Programme\Internet\HiJackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/ R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Anderes\Adobe Reader\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: 0190/0900 Warner Browser Helper - {D2F63D33-C571-41E9-9525-A17CA1804D3B} - E:\PROGRA~1\Internet\0190WA~1\whelper1.dll O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-f7ed0776fb27} - e:\programme\internet\stegano\sia2006iep.dll O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] E:\Programme\Internet\Webcam\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] E:\Programme\Internet\Webcam\LogiTray.exe O4 - HKLM\..\Run: [avgnt] "E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ICQ Lite] "E:\Programme\Internet\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ThreatFire] E:\Programme\Internet\ThreatFire\TFTray.exe O4 - HKLM\..\Run: [NortonAntiBot] "E:\Programme\Internet\Norten AntiBot\agent\bin\NortonAntiBot.exe" O4 - HKLM\..\Run: [TrueImageMonitor.exe] E:\Programme\Internet\Acronis True Image\TrueImageMonitor.exe O4 - HKLM\..\Run: [AcronisTimounterMonitor] E:\Programme\Internet\Acronis True Image\TimounterMonitor.exe O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe" O4 - HKLM\..\Run: [a-squared] "E:\Programme\Internet\a-squared Anti-Dialer\a2adguard.exe" O4 - HKLM\..\Run: [SmcService] E:\PROGRA~1\Internet\SYGATE~1\smc.exe -startgui O4 - HKLM\..\Run: [a-squared Anti-Dialer] "E:\Programme\Internet\a-squared Anti-Dialer\a2adguard.exe" /d=60 O4 - HKCU\..\Run: [LogitechSoftwareUpdate] E:\Programme\Internet\Webcam\ManifestEngine.exe boot O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Programme\Internet\Spybot\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\RunOnce: [SIA2006] "E:\Programme\Internet\Stegano\SIA2006.exe" -firstboot (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-20\..\RunOnce: [SIA2006] "E:\Programme\Internet\Stegano\SIA2006.exe" -firstboot (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [SIA2006] "E:\Programme\Internet\Stegano\SIA2006.exe" -firstboot (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [SIA2006] "E:\Programme\Internet\Stegano\SIA2006.exe" -firstboot (User 'Default user') O4 - Startup: Mousometer.lnk = E:\Programme\Anderes\Mousometer\mousometer.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe O4 - Global Startup: Logitech SetPoint.lnk = E:\Programme\Anderes\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = E:\Programme\Anderes\Microsoft Office Premium\Office\OSA9.EXE O4 - Global Startup: T-COM WLAN Manager T-Sinus 154data.lnk = C:\Programme\T-COM\T-COM WLAN Manager T-Sinus 154data\Installer\WINXP\DTUSB11GMonitor.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://E:\Programme\Internet\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Programme\Internet\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - E:\Programme\Internet\ICQ6\ICQ.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Internet\Yahoo\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\PROGRA~1\Internet\Yahoo\MESSEN~1\YPager.exe O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Partypoker\PartyPokerNet\RunPF.exe O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - D:\Partypoker\PartyPokerNet\RunPF.exe O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {78FC337F-6AEB-4CFE-8380-8A7CAD915CCC} - E:\Programme\Anderes\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {78FC337F-6AEB-4CFE-8380-8A7CAD915CCC} - E:\Programme\Anderes\xp-AntiSpy\sponsoring\sponsor.html (HKCU) O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/040b51522d7e6941c618/netzip/RdxIE601_de.cab O23 - Service: 0190/0900 Warner Überwachungsdienst (0190_0900_Warner_MonitorService) - Mirko Böer - E:\Programme\Internet\0190 Warner\w0svc.exe O23 - Service: a-squared Anti-Dialer Service (a2AntiDialer) - Emsi Software GmbH - E:\Programme\Internet\a-squared Anti-Dialer\a2service.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Programme\Internet\Ad-Aware\aawservice.exe O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - Avira GmbH - E:\Programme\Internet\AntiVir\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - E:\Programme\Internet\Registry Mechanic\SbieSvc.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\Programme\Internet\Sygate Firewall\smc.exe O23 - Service: SymantecAntiBotAgent - Symantec - E:\Programme\Internet\Norten AntiBot\agent\Bin\NABAgent.exe O23 - Service: SymantecAntiBotWatcher - Symantec - E:\Programme\Internet\Norten AntiBot\agent\Bin\NABWatcher.exe O23 - Service: ThreatFire - PC Tools - E:\Programme\Internet\ThreatFire\TFService.exe -- End of file - 10486 bytes
