Tach leute,
meine Schwester war an meinem laptop und ich vermute die hat sich da was eingefangen.
Habe Windows 7 Home Premium, und einen Laptop von Acer Aspire.
So, weiter beim Thema!
Ich starte den laptop und alles hängt. Es geht dauernd eine Meldung auf das ich 21 Viren aufm Laptop habe, und wenn ich auf Remove drücke, werde ich zu einer Internetseite geleitet wo ich Security Suite kaufen soll.
Naja, ich kann nicht ins Internet und kann nix starten, da er immer sagt. Die (ccc. , skypenames. usw) exe. ist verseucht ist.
Habe gerade in dem Acer karton geschaut, keine CD zum formatieren dabei, NIX!
Habe eine Systemwiederherstellung gemacht um wenigstens ins Internet zu kommen.
Habe im Abgesicherten Modus, den "Trojaner" in Quarantäne verschoben, und Hijack logfile schon paar schauen gefixxed.
Aber hier nochmal:
Logfile of Trend Micro HijackThis v2_0_2
Scan saved at 20:40:59, on 19_08_2010
Platform: Unknown Windows (WinNT 6_01_3504)
MSIE: Internet Explorer v8_00 (8_00_7600_16385)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif-exe
C:\Windows\PLFSetI-exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr-exe
C:\Program Files (x86)\Launch Manager\LManager-exe
C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate-exe
C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent-exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched-exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt-exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck-exe
C:\Program Files (x86)\Internet Explorer\iexplore-exe
C:\Program Files (x86)\Internet Explorer\iexplore-exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c-exe
C:\Program Files (x86)\ICQ7_0\ICQ-exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis-exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = _homepage-acer-com/rdr-aspx?b=ACAW&l=0407&m=aspire_5732z&r=27360210l755l0354z115t5992c342
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = __-arcor-de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = __-arcor-de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = __-arcor-de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = __-arcor-de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = __-arcor-de
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = __-arcor-de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank-htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system-ini: UserInit=userinit-exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim-dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin-dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin-dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv-dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~2\FlashFXP\IEFlash-dll
O4 - HKLM\_.\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager-exe
O4 - HKLM\_.\Run: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate-exe"
O4 - HKLM\_.\Run: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent-exe"
O4 - HKLM\_.\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched-exe"
O4 - HKLM\_.\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt-exe" /min
O4 - HKLM\_.\Run: [StartCCC] "C:\Users\Sale\Documents\Meine empfangenen Dateien\ATI-ACE\Core-Static\CLIStart-exe" MSRun
O4 - HKCU\_.\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr-exe" /background
O4 - HKUS\S-1-5-19\_.\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar-exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\_.\RunOnce: [mctadmin] C:\Windows\System32\mctadmin-exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\_.\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar-exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\_.\RunOnce: [mctadmin] C:\Windows\System32\mctadmin-exe (User 'NETZWERKDIENST')
O4 - Global Startup: EA_RESTART_001-lnk = C:\Users\Sale\AppData\Local\Temp\AutoRun-exe
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Sale\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3-htm
O8 - Extra context menu item: Google Sidewiki_.. - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8-dll/cmsidewiki-html
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7_0\ICQ-exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7_0\ICQ-exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin-dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin-dll
O9 - Extra button: PartyPoker-com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp-exe
O9 - Extra 'Tools' menuitem: PartyPoker-com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp-exe
O13 - Gopher Prefix:
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} (SysInfo Class) - [url]_content-systemrequirementslab-com_s3-amazonaws-com/global/bin/srldetect_cyri_4_1_71_0-cab[/url]
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} (FBootloaderAX) - [url]__-facebook-com/fbplugin/win32/axfbootloader-cab?1266008660797[/url]
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - [url]_tools-ebayimg-com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-29-0-cab[/url]
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - [url]_messenger-zone-msn-com/binary/MessengerStatsPAClient-cab56907-cab[/url]
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin-dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1-DLL
O23 - Service: _%SystemRoot%\system32\Alg-exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg-exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx-exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched-exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard-exe
O23 - Service: _%SystemRoot%\system32\efssvc-dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass-exe (file missing)
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer ePower Management\ePowerSvc-exe
O23 - Service: _%systemroot%\system32\fxsresm-dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc-exe (file missing)
O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW-exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon-exe
O23 - Service: _keyiso-dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass-exe (file missing)
O23 - Service: _comres-dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc-exe (file missing)
O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService-exe
O23 - Service: _%SystemRoot%\System32\netlogon-dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass-exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon-des-exe (file missing)
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc-exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc-exe
O23 - Service: _%systemroot%\system32\psbase-dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass-exe (file missing)
O23 - Service: _%systemroot%\system32\Locator-exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator-exe (file missing)
O23 - Service: _%SystemRoot%\system32\samsrv-dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass-exe (file missing)
O23 - Service: _%SystemRoot%\system32\snmptrap-exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap-exe (file missing)
O23 - Service: _%systemroot%\system32\spoolsv-exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv-exe (file missing)
O23 - Service: _%SystemRoot%\system32\sppsvc-exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc-exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService-exe
O23 - Service: _%SystemRoot%\system32\ui0detect-exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect-exe (file missing)
O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService-exe
O23 - Service: _%SystemRoot%\system32\vaultsvc-dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass-exe (file missing)
O23 - Service: _%SystemRoot%\system32\vds-exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds-exe (file missing)
O23 - Service: _%systemroot%\system32\vssvc-exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc-exe (file missing)
O23 - Service: _%systemroot%\system32\wbengine-exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine-exe (file missing)
O23 - Service: _%Systemroot%\system32\wbem\wmiapsrv-exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv-exe (file missing)
O23 - Service: _%PROGRAMFILES%\Windows Media Player\wmpnetwk-exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk-exe (file missing)
--
End of file - 10558 bytes
Antivir sagt mir gerad beim Systemcheck: 2 Funde, Letzter Fund: TR/Agent-auw
Bitte helft mir sonst betonier ich das ding -_-
Bw ist klar.
Fanatico