Hallo Ruby,
vielen Dank für die Erklärungen zu den von mir gestellten Fragen!
Klar bin ich dazu hier, mein PCSystem mit Eurer geschätzten Unterstützung zu reinigen - wozu sonst?
Desweiteren möchte ich anmerken, dass der von mir verwendete Ausdruck "Frau am PC" lediglich scherzhaft gemeint war und nicht etwa bedeuten sollte, dass ich als Frau auf bevorzugte Behandlung hoffte - es kam mir vor, als hättest du das ein wenig missverstanden ... !? 
Entschuldige bitte!
Und: Ich hoffe doch, dass ich in etwa in der Lage war, die von Dir an mich gerichteten Anweisungen zu befolgen. Sorry, aber hatte die letzten Tage dazu leider wenig Zeit, deshalb erst jetzt erste Ergebnisse:
Code:
Logfile of HijackThis v1.99.1
Scan saved at 16:02:59, on 27.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\sisUSBrg.exe
O4 - HKLM\..\Run: [0190 Warner] C:\PROGRA~1\0190WA~1\WARN0190.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programme\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programme\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Programme\ScanSoft\PDF Converter\RegistryController.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [HDDHealth] C:\Programme\HDD Health\HDDHealth.exe -wl
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
# Gibt es allgemeine Auffälligkeiten? Habe ich die Anweisungen, die ich hierfür hatte, richtig ausgeführt?
# Hatte mal NortonAntiVirus... Das ist aber schon eine Weile deinstalliert, denn ich habe ja jetzt AntiVir.Pers.Edt.Class.f.WinXP - wie verhält es sich also mit dem 1.,3. & 5. O16-DPF-Eintrag im HjT-Logfile? "Können die nicht auch raus"?
Code:
Ad-Aware SE Build 1.06r1
Logfile Created on:Montag, 27. Juni 2005 21:38:21
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R51 21.06.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):1 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Definition File:
=========================
Definitions File Loaded:
Reference Number : SE1R51 21.06.2005
Internal build : 59
File location : C:\Programme\Lavasoft\Ad-Aware SE Personal\defs.ref
File size : 483435 Bytes
Total size : 1461660 Bytes
Signature data size : 1429955 Bytes
Reference data size : 31193 Bytes
Signatures total : 40756
CSI Fingerprints total : 906
CSI data size : 31253 Bytes
Target categories : 15
Target families : 694
Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium IV
Memory available:37 %
Total physical memory:228848 kb
Available physical memory:84416 kb
Total page file size:559092 kb
Available on page file:316676 kb
Total virtual memory:2097024 kb
Available virtual memory:2008564 kb
OS:Microsoft Windows XP Home Edition Service Pack 2 (Build 2600)
Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Search for low-risk threats
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Obtain command line of scanned processes
Set : Run scan as background process (Low CPU usage)
Set : Scan registry for all users instead of current user only
Set : Use permanent archive caching
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Disable manual quarantine if auto-quarantine is selected
Set : Reanalyze results after scanning before displaying results lists
Set : Write-protect system files after repair (Hosts file, etc.)
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Create log file for removal operations
Set : Create and save WebUpdate log file
Set : Play sound at scan completion if scan locates critical objects
27.06.2005 21:38:21 - Scan started. (Full System Scan)
MRU List Object Recognized!
Location: : S-1-5-21-3599621574-3115698113-2545290300-1003\software\microsoft\internet explorer\typedurls
Description : list of recently entered addresses in microsoft internet explorer
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
ModuleName : \SystemRoot\System32\smss.exe
Command Line : n/a
ProcessID : 476
ThreadCreationTime : 27.06.2005 17:44:52
BasePriority : Normal
#:2 [csrss.exe]
ModuleName : \??\C:\WINDOWS\system32\csrss.exe
Command Line : C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestTh
ProcessID : 528
ThreadCreationTime : 27.06.2005 17:44:56
BasePriority : Normal
#:3 [winlogon.exe]
ModuleName : \??\C:\WINDOWS\system32\winlogon.exe
Command Line : winlogon.exe
ProcessID : 552
ThreadCreationTime : 27.06.2005 17:44:57
BasePriority : High
#:4 [services.exe]
ModuleName : C:\WINDOWS\system32\services.exe
Command Line : C:\WINDOWS\system32\services.exe
ProcessID : 596
ThreadCreationTime : 27.06.2005 17:44:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Anwendung für Dienste und Controller
InternalName : services.exe
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : services.exe
#:5 [lsass.exe]
ModuleName : C:\WINDOWS\system32\lsass.exe
Command Line : C:\WINDOWS\system32\lsass.exe
ProcessID : 608
ThreadCreationTime : 27.06.2005 17:44:57
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : lsass.exe
#:6 [svchost.exe]
ModuleName : C:\WINDOWS\system32\svchost.exe
Command Line : C:\WINDOWS\system32\svchost -k DcomLaunch
ProcessID : 752
ThreadCreationTime : 27.06.2005 17:44:58
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:7 [svchost.exe]
ModuleName : C:\WINDOWS\system32\svchost.exe
Command Line : C:\WINDOWS\system32\svchost -k rpcss
ProcessID : 836
ThreadCreationTime : 27.06.2005 17:44:58
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:8 [svchost.exe]
ModuleName : C:\WINDOWS\System32\svchost.exe
Command Line : C:\WINDOWS\System32\svchost.exe -k netsvcs
ProcessID : 872
ThreadCreationTime : 27.06.2005 17:44:58
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:9 [svchost.exe]
ModuleName : C:\WINDOWS\System32\svchost.exe
Command Line : C:\WINDOWS\System32\svchost.exe -k NetworkService
ProcessID : 920
ThreadCreationTime : 27.06.2005 17:44:58
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:10 [svchost.exe]
ModuleName : C:\WINDOWS\System32\svchost.exe
Command Line : C:\WINDOWS\System32\svchost.exe -k LocalService
ProcessID : 1020
ThreadCreationTime : 27.06.2005 17:44:59
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:11 [explorer.exe]
ModuleName : C:\WINDOWS\Explorer.EXE
Command Line : C:\WINDOWS\Explorer.EXE
ProcessID : 1284
ThreadCreationTime : 27.06.2005 17:45:01
BasePriority : Normal
FileVersion : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 6.00.2900.2180
ProductName : Betriebssystem Microsoft® Windows®
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFilename : EXPLORER.EXE
#:12 [spoolsv.exe]
ModuleName : C:\WINDOWS\system32\spoolsv.exe
Command Line : C:\WINDOWS\system32\spoolsv.exe
ProcessID : 1356
ThreadCreationTime : 27.06.2005 17:45:02
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : spoolsv.exe
#:13 [avguard.exe]
ModuleName : C:\Programme\AVPersonal\AVGUARD.EXE
Command Line : C:\Programme\AVPersonal\AVGUARD.EXE
ProcessID : 1524
ThreadCreationTime : 27.06.2005 17:45:03
BasePriority : Normal
#:14 [warn0190.exe]
ModuleName : C:\PROGRA~1\0190WA~1\WARN0190.EXE
Command Line : "C:\PROGRA~1\0190WA~1\WARN0190.EXE"
ProcessID : 1604
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
FileVersion : 3.50.0.158
ProductVersion : 3.50
ProductName : 0190 Warner / 0900 Warner
CompanyName : Mirko Böer
FileDescription : 0190 Warner / 0900 Warner
LegalCopyright : Copyright © 2001 - 2003 Mirko Böer
Comments : http://www.wt-rate.com/
#:15 [avwupsrv.exe]
ModuleName : C:\Programme\AVPersonal\AVWUPSRV.EXE
Command Line : "C:\Programme\AVPersonal\AVWUPSRV.EXE"
ProcessID : 1608
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
#:16 [logitray.exe]
ModuleName : C:\Programme\Logitech\ImageStudio\LogiTray.exe
Command Line : "C:\Programme\Logitech\ImageStudio\LogiTray.exe"
ProcessID : 1640
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
FileVersion : 7.2.0.1125
ProductVersion : 7.2.0.1125
ProductName : Logitech ImageStudio
CompanyName : Logitech Inc.
FileDescription : ImageStudio Tray Application
InternalName : LogiTray.exe
LegalCopyright : (c) 1996-2002 Logitech. All rights reserved.
OriginalFilename : LogiTray.exe
#:17 [lvcomsx.exe]
ModuleName : C:\WINDOWS\system32\LVCOMSX.EXE
Command Line : "C:\WINDOWS\system32\LVCOMSX.EXE"
ProcessID : 1648
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
FileVersion : 8.4.1.1092
ProductVersion : 8.4.1.1092
ProductName : Logitech QuickCam
CompanyName : Logitech Inc.
FileDescription : LVCom Server
InternalName : LVComS.exe
LegalCopyright : (c) 1996-2004 Logitech. All rights reserved.
OriginalFilename : LVComS.exe
#:18 [logitray.exe]
ModuleName : C:\Programme\Logitech\Video\LogiTray.exe
Command Line : "C:\Programme\Logitech\Video\LogiTray.exe"
ProcessID : 1672
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
FileVersion : 8.4.1.1092
ProductVersion : 8.4.1.1092
ProductName : Logitech QuickCam
CompanyName : Logitech Inc.
FileDescription : ImageStudio Tray Application
InternalName : LogiTray.exe
LegalCopyright : (c) 1996-2004 Logitech. All rights reserved.
OriginalFilename : LogiTray.exe
#:19 [jusched.exe]
ModuleName : C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
Command Line : "C:\Programme\Java\jre1.5.0_02\bin\jusched.exe"
ProcessID : 1688
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
#:20 [avgnt.exe]
ModuleName : C:\Programme\AVPersonal\AVGNT.EXE
Command Line : "C:\Programme\AVPersonal\AVGNT.EXE" /min
ProcessID : 1696
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
#:21 [ctfmon.exe]
ModuleName : C:\WINDOWS\system32\ctfmon.exe
Command Line : "C:\WINDOWS\system32\ctfmon.exe"
ProcessID : 1708
ThreadCreationTime : 27.06.2005 17:45:04
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : CTF Loader
InternalName : CTFMON
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : CTFMON.EXE
#:22 [mdm.exe]
ModuleName : C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
Command Line : "C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe"
ProcessID : 1796
ThreadCreationTime : 27.06.2005 17:45:05
BasePriority : Normal
FileVersion : 7.00.9064.9150
ProductVersion : 7.00.9064.9150
ProductName : Microsoft Development Environment
CompanyName : Microsoft Corporation
FileDescription : Machine Debug Manager
InternalName : mdm.exe
LegalCopyright : Copyright (C) Microsoft Corp. 1997-2000
OriginalFilename : mdm.exe
#:23 [aim.exe]
ModuleName : C:\PROGRA~1\AIM95\aim.exe
Command Line : "C:\PROGRA~1\AIM95\aim.exe" -cnetwait.odl
ProcessID : 1912
ThreadCreationTime : 27.06.2005 17:45:06
BasePriority : Normal
FileVersion : 5.1.3036
ProductVersion : 5.1.3036
ProductName : AOL Instant Messenger
CompanyName : America Online, Inc.
FileDescription : AOL Instant Messenger
InternalName : AIM
LegalCopyright : Copyright © 1996-2002 America Online, Inc.
OriginalFilename : AIM.EXE
#:24 [slserv.exe]
ModuleName : C:\WINDOWS\system32\slserv.exe
Command Line : slserv.exe
ProcessID : 1992
ThreadCreationTime : 27.06.2005 17:45:07
BasePriority : Normal
FileVersion : 2.80.00(24Apr2000)
ProductVersion : 2.80.00
ProductName : Modem
FileDescription : User-Level Modem Service
InternalName : slserv
LegalCopyright : Copyright © 1999-2000
OriginalFilename : slserv.exe
#:25 [hddhealth.exe]
ModuleName : C:\Programme\HDD Health\HDDHealth.exe
Command Line : "C:\Programme\HDD Health\HDDHealth.exe" -wl
ProcessID : 2000
ThreadCreationTime : 27.06.2005 17:45:07
BasePriority : Normal
FileVersion : 2.1.0.159
ProductVersion : 2.1
CompanyName : PANTERASoft
#:26 [svchost.exe]
ModuleName : C:\WINDOWS\System32\svchost.exe
Command Line : C:\WINDOWS\System32\svchost.exe -k imgsvc
ProcessID : 2040
ThreadCreationTime : 27.06.2005 17:45:08
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : svchost.exe
#:27 [teatimer.exe]
ModuleName : C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
Command Line : "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe"
ProcessID : 128
ThreadCreationTime : 27.06.2005 17:45:08
BasePriority : Idle
FileVersion : 1, 4, 0, 2
ProductVersion : 1, 4, 0, 3
ProductName : Spybot - Search & Destroy
CompanyName : Safer Networking Limited
FileDescription : System settings protector
InternalName : TeaTimer
LegalCopyright : © 2000-2005 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : TeaTimer.exe
Comments : Schützt Systemeinstellungen vor ungewollten Änderungen.
#:28 [wdfmgr.exe]
ModuleName : C:\WINDOWS\system32\wdfmgr.exe
Command Line : C:\WINDOWS\system32\wdfmgr.exe
ProcessID : 280
ThreadCreationTime : 27.06.2005 17:45:09
BasePriority : Normal
FileVersion : 5.2.3790.1230 built by: DNSRV(bld4act)
ProductVersion : 5.2.3790.1230
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows User Mode Driver Manager
InternalName : WdfMgr
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : WdfMgr.exe
#:29 [fxsvr2.exe]
ModuleName : C:\Programme\Logitech\Video\FxSvr2.exe
Command Line : "C:\Programme\Logitech\Video\FxSvr2.exe" -Embedding
ProcessID : 456
ThreadCreationTime : 27.06.2005 17:45:10
BasePriority : Normal
FileVersion : 8.4.1.1092
ProductVersion : 8.4.1.1092
ProductName : Logitech QuickCam
CompanyName : Logitech Inc.
FileDescription : QuickCam Framework Server
InternalName : FxSvr.EXE
LegalCopyright : (c) 1996-2004 Logitech. All rights reserved.
OriginalFilename : FxSvr.EXE
#:30 [alg.exe]
ModuleName : C:\WINDOWS\System32\alg.exe
Command Line : C:\WINDOWS\System32\alg.exe
ProcessID : 2380
ThreadCreationTime : 27.06.2005 17:45:41
BasePriority : Normal
FileVersion : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ProductVersion : 5.1.2600.2180
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Application Layer Gateway Service
InternalName : ALG.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : ALG.exe
#:31 [smartsurfer.exe]
ModuleName : C:\Programme\WEBDE\SmartSurfer2.31\SmartSurfer.exe
Command Line : "C:\Programme\WEBDE\SmartSurfer2.31\SmartSurfer.exe"
ProcessID : 2640
ThreadCreationTime : 27.06.2005 17:55:16
BasePriority : Normal
FileVersion : 3.00.003
ProductVersion : 3.0.1
ProductName : SmartSurfer
CompanyName : WEB.DE AG
FileDescription : Least Cost Router
InternalName : SmartSurfer2x
LegalCopyright : Copyright (C) 2000 WEB.DE AG
OriginalFilename : SmartSurfer2x.EXE
Comments : Least Cost Router
#:32 [msn6.exe]
ModuleName : C:\Programme\MSN\MSNCoreFiles\msn6.exe
Command Line : "C:\Programme\MSN\MSNCoreFiles\msn6.exe"
ProcessID : 3536
ThreadCreationTime : 27.06.2005 17:55:56
BasePriority : Normal
FileVersion : 7.02.0010.1600
ProductVersion : 7.02.0010.1600
ProductName : Microsoft(R) MSN (R) Kommunikationssystem
CompanyName : Microsoft Corporation
FileDescription : msn
InternalName : msn
LegalCopyright : Copyright (C) Microsoft Corp. 1981-2000
OriginalFilename : msn.exe
#:33 [msnmsgr.exe]
ModuleName : C:\Programme\MSN Messenger\msnmsgr.exe
Command Line : "C:\Programme\MSN Messenger\msnmsgr.exe" -Embedding
ProcessID : 3768
ThreadCreationTime : 27.06.2005 17:56:06
BasePriority : Normal
FileVersion : 7.0.0777
ProductVersion : 7.0.0777
ProductName : MSN Messenger
CompanyName : Microsoft Corporation
FileDescription : MSN Messenger
InternalName : msnmsgr
LegalCopyright : Copyright (c) Microsoft Corporation 1997-2004
LegalTrademarks : Microsoft(R) is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.
OriginalFilename : msnmsgr.exe
#:34 [slrundll.exe]
ModuleName : C:\WINDOWS\system32\slrundll.exe
Command Line : slrundll.exe SLGen.dll,SLRunServ SYSTEM\CURRENTCONTROLSET\CONTROL\CLASS\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000
ProcessID : 3140
ThreadCreationTime : 27.06.2005 18:00:15
BasePriority : Normal
#:35 [winword.exe]
ModuleName : C:\Programme\Microsoft Office\Office10\WINWORD.EXE
Command Line : "C:\Programme\Microsoft Office\Office10\WINWORD.EXE" /n /dde
ProcessID : 1328
ThreadCreationTime : 27.06.2005 18:43:34
BasePriority : Normal
#:36 [ad-aware.exe]
ModuleName : C:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
Command Line : "C:\Programme\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe"
ProcessID : 992
ThreadCreationTime : 27.06.2005 18:45:10
BasePriority : Idle
FileVersion : 6.2.0.236
ProductVersion : SE 106
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft AB Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
7636 entries scanned.
New critical objects:0
Objects found so far: 1
Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1
21:57:52 Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:19:30.533
Objects scanned:105782
Objects identified:0
Objects ignored:0
New critical objects:0
Reanalyzing scan result
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
No objects have been removed from the result list.
#Gibt es allgemeine Auffälligkeiten? Habe ich die Anweisungen, die ich hierfür hatte, richtig ausgeführt?
#Ist evtl. eine Einstellung falsch, weil das Logfile so lang ist(schreibt es "Unnötiges" auf, was ich abstellen könnte?)
#Jedes Mal, wenn ich nun einen Scan durchführe, findet er zwar keine "critical objects" mehr, aber solche MRU-Listen - kann ich diese immer bedenkenlos löschen?
#Mit dem Programm 'RTE-Remove-Beta' habe ich leider Probleme folgender Art: Habe es im abgesicherten Modus benutzen wollen, aber wenn ich auf die 'Kill Elite Toolbar'-Taste drückte, ging ein Warnfeld mit folgender Info auf: "Warning message: We suggest you to run this program in Safe Mode, anyway you can try giving it a chance in Normal Mode. Do you want to continue? YES or NO" --- ich drückte YES! --- dann kam ein weiteres Feld: "Elite Toolbar Remover: Laufzeitfehler '5': ungültiger Prozeduraufruf oder ungültiges Argument. OK" --- ich drückte OK! Tja, weiter kam ich dort auch bei mehrfachem Versuch nicht. Was hab' ich falsch gemacht bzw. woran liegt das, was bedeutet diese Meldung(das Englische verstehe ich, nur weiß ich nicht, was es im Allgemeinen zu bedeuten hat)? Unten in der Data Log stand noch folgendes, was eigentlich normal erscheint: " 19:41:07(uhrzeit): start scanning procedures... 19:41:07(uhrzeit): loading definitions list... 19:41:07(uhrzeit): definitions list correctly loaded! " Ist das normal, alles in einer Sekunde?
Code:
AboutBuster 5.0 reference file 30
Scan started on [27.06.2005] at [19:34:46]
------------------------------------------------
No Ads Found!
------------------------------------------------
No Files Found!
------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 19:35:56
# Ist hier alles ok?
Soweit erstmal.
Das Panda-ActiveScan-Logfile poste ich dann mit dem RTE-Remove-Beta-Logfile(RTE:wenn ich das dortige Problem mit Deiner/Eurer Hilfe rausfinde und behoben habe) - hoffe, das ist ok so?
Ich danke vielmals für Deine/Eure Hilfe.
Lg sternenfee
Tipps zu HJT-Logfile gesucht ...
,
):
AW: Tipps zu HJT-Logfile gesucht ...
AW: Tipps zu HJT-Logfile gesucht ...
