Tach ihr,
mein AVG Virenscanner ist plätzlich aufgepoppt und hat mir den Trojaer "gemeldet".
Ist das jetzt ein Adware oder Böse oder nicht schlimm oder doch schlimm?
Ich hab als letztes des Foxit PDF Editor installiert.
Hijack Spukte folgendes aus, ich find da nix verdächtiges.
Für Infos wär ich dankbar.
grüße, thomas
PS: Ich geh nie mim IE ins netz, nur FF und alles eigentlich auch ohne Schweinkarm und Hack-seiten...
Logfile of HijackThis v1.99.1
Scan saved at 19:33:47, on 04.10.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\Programme\Sygate\SPF\smc.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\PROGRA~2\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~2\Grisoft\AVG7\avgupsvc.exe
E:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
E:\Programme\ewido anti-spyware 4.0\guard.exe
E:\Programme\CDBurnerXP Pro 3\Tools\NMSAccess.exe
E:\WINNT\system32\nvsvc32.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\Programme\WinPoET Broadband Connection\WrOS.EXE
E:\WINNT\system32\mspmspsv.exe
E:\WINNT\Explorer.EXE
E:\Programme\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
E:\Programme\DTemp\DTemp.exe
E:\Programme\FreePDF_XP\fpassist.exe
E:\PROGRA~2\Grisoft\AVG7\avgcc.exe
E:\WINNT\system32\RUNDLL32.EXE
E:\Programme\Java\jre1.5.0_08\bin\jusched.exe
E:\WINNT\system32\internat.exe
E:\WINNT\system32\spool\drivers\w32x86\2\fpdisp4.exe
E:\Programme\Transparent Icons\TI15.exe
E:\Programme\Mozilla Firefox\firefox.exe
E:\Programme\WinRAR\WinRAR.exe
E:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\Rar$EX00.444\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: (no name) - {B7672BAF-E9A3-49B6-86B2-C81719A18A4C} - E:\WINNT\system32\gkvovabm.dll
O2 - BHO: (no name) - {BBEFE720-0E6E-42E0-BA23-92D52B8837ED} - E:\WINNT\system32\tussq.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LWBMOUSE] E:\Programme\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [dtemp] E:\Programme\DTemp\DTemp.exe
O4 - HKLM\..\Run: [FreePDF Assistant] E:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [a-winpoet-service] REM "E:\Programme\WinPoET Broadband Connection\winpppoverethernet.exe"
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "E:\Programme\RivaTuner v2.0 RC 15.6\RivaTuner.exe" /S
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~2\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Programme\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [SmcService] E:\PROGRA~2\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Fineprint Dispatcher] E:\WINNT\system32\spool\drivers\w32x86\2\fpdisp4.exe /verbose
O4 - HKCU\..\Run: [AutoStart-Manager] REM E:\Programme\LAB1.de\Autostart-Manager\AutoStart-Manager.exe /AUTOSTART
O4 - HKCU\..\Run: [transp Icon] E:\Programme\Transparent Icons\TI15.exe
O4 - HKCU\..\Run: [Skype] REM "E:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [desktopchange] REM E:\Programme\changewallpaper\CHGWALLP.EXE
O4 - HKCU\..\Run: [AutoStart-Manager 2006] "E:\Programme\Tools&More\Autostart-Manager\AutoStart-Manager.exe" /AUTOSTART
O4 - Startup: Hintergrundbild wechseln.lnk = E:\Programme\changewallpaper\CHGWALLP.EXE
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = E:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = E:\Programme\Sitecom\Bluetooth Software\BTTray.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Programme\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Senden an &Bluetooth - E:\Programme\Sitecom\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programme\Sitecom\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - E:\Programme\Sitecom\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - E:\Programme\Agnitum\Outpost Firewall\trash.exe (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan - {072F3B8A-2DA2-40e2-B841-88899F240200} - E:\Programme\Agnitum\Outpost Firewall\trash.exe (file missing) (HKCU)
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - E:\WINNT\system32\shdocvw.dll (HKCU)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122406683752
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123416682038
O17 - HKLM\System\CCS\Services\Tcpip\..\{21A7E6CD-79C1-4A80-9AA1-C24F20FEF8ED}: NameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{977F96D5-8670-4DF3-BC5C-3550DE6F9B5E}: NameServer = 192.168.0.1
O20 - Winlogon Notify: tussq - E:\WINNT\system32\tussq.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~2\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~2\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - E:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - E:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: License Management Service ESD - element5 - E:\Programme\Gemeinsame Dateien\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: NMSAccess - Unknown owner - E:\Programme\CDBurnerXP Pro 3\Tools\NMSAccess.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINNT\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - E:\Programme\Sygate\SPF\smc.exe
O23 - Service: windows logon - Unknown owner - E:\WINNT\winlogon.exe (file missing)
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - E:\Programme\WinPoET Broadband Connection\WrOS.EXE
