Logfile von Trend Micro HijackThis V2.0.2
Scan gespeichert um 8:53:08 Uhr, am 2/27/2009
Plattform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer V6.00 SP3 (6.00.2900.5512)
Boot-Modus: Normal
Laufenden Prozesse:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ winlogon.exe
C: \ WINDOWS \ system32 \ services.exe
C: \ WINDOWS \ system32 \ lsass.exe
C: \ Program Files \ Faronics \ Deep Freeze \ Installieren Sie C-0 \ DF5Serv.exe
C: \ WINDOWS \ system32 \ svchost. exe
C: \ WINDOWS \ System32 \ svchost.exe
C: \ WINDOWS \ Explorer.EXE
C: \ Program Files \ Faronics \ Deep Freeze \ Install C-0 \ _ $ Df \ FrzState2k.exe
C \ WINDOWS \ system32 \ spoolsv.exe
C: \ WINDOWS \ system32 \ RUNDLL32.EXE
C: \ Program Files \ HP \ Digital Imaging \ bin \ hpqSRMon.exe
C: \ WINDOWS \ system32 \ ctfmon.exe
C: \ VSTASCAN \ vsaccess.exe
C: \ Programme \ Gemeinsame Dateien \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Program Files \ Bonjour \ mDNSResponder. exe
C: \ Program Files \ Symantec \ Norton Ghost 2003 \ GhostStartService.exe
C: \ WINDOWS \ system32 \ nvsvc32.exe
C: \ WINDOWS \ system32 \ HPZipm12.exe
C: \ WINDOWS \ system32 \ svchost.exe
C: \ Program Files \ Viewpoint \ Common \ ViewpointService.exe
C: \ Program Files \ Mozilla Firefox \ firefox.exe
C: \ WINDOWS \ system32 \ taskmgr.exe
C: \ Program Files \ Trend Micro \ HijackThis \ HijackThis. exe
R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar =
http://us.rd.yahoo.com/customize/ie/def ... earch.htmlR1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page =
http://us.rd.yahoo.com/customize/ie/def ... .yahoo.comR0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page =
http://www.yahoo.com/R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL =
http://www.yahoo.com/R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL =
http://us.rd.yahoo.com/customize/ie/def ... .yahoo.comR1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Bar =
http://us.rd.yahoo.com/customize/ie/def ... earch.htmlR1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page =
http://us.rd.yahoo.com/customize/ie/def ... .yahoo.comR0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page =
http://www.yahoo.com/R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ SearchURL, (Default) =
http://us.rd.yahoo.com/customize/ie/def ... .yahoo.comR1 - HKCU \ Software \ Microsoft \ Internet Connection Wizard, ShellNext =
http://stats.garena.com/clientinstall.phpR1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings, ProxyOverride = *. lokal;
http://192.168.0.150:918O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C: \ Programme \ Gemeinsame Dateien \ Adobe \ Acrobat \ ActiveX \ AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - (761497BB-D6F0-462C-B6EB-D4DAF1D92D43) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll
O2 - BHO: (no name) - (7E853D72-626A-48EC-A868-BA8D5E23E045) - (no file)
O4 - HKLM \ .. \ Run: [NvCplDaemon] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvCpl.dll, NvStartup
O4 - HKLM \ .. \ Run: [nwiz] nwiz. exe / install
O4 - HKLM \ .. \ Run: [NvMediaCenter] RUNDLL32.EXE C: \ WINDOWS \ system32 \ NvMcTray.dll, NvTaskbarInit
O4 - HKLM \ .. \ Run: [hpqSRMon] C: \ Program Files \ HP \ Digital Imaging \ bin \ hpqSRMon.exe
O4 - HKLM \ .. \ Run: [KernelFaultCheck]% systemroot% \ system32 \ dumprep 0-k
O4 - HKLM \ .. \ RunOnce: [WIAWizardMenu] RUNDLL32.EXE C: \ WINDOWS \ system32 \ sti_ci.dll, WiaCreateWizardMenu
O4 - HKCU \ .. \ Run: [ctfmon.exe] C: \ WINDOWS \ system32 \ ctfmon.exe
O4 - Startup: UMAX VistaAccess. lnk = C: \ VSTASCAN \ vsaccess.exe
O8 - Extra Kontext Menüpunkt: E & Xport auf Microsoft Excel --
res://C : \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ EXCEL.EXE/3000
O9 - Extra Knopf: (no name) - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv.dll
O9 - Extra "Extras" menuitem: Sun Java Console - (08B0E5C0-4FCB-11CF-AAA5-00401C608501) - C: \ Program Files \ Java \ jre1.6.0_07 \ bin \ ssv. dll
O9 - Extra-Taste: Paltalk - (4EAFEF58-EEFA-4116-983D-03B49BCBFFFE) - C: \ Program Files \ Paltalk Messenger \ Paltalk.exe
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MICROS ~ 2 \ Office12 \ REFIEBAR.DLL
O9 - Extra button: Run IMVU - (d9288080-1baa-4bc4-9cf8-a92d743db949) - C: \ Dokumente und Einstellungen \ PC \ Startmenü \ Programme \ IMVU \ Run IMVU. lnk (file missing)
O9 - Extra Knopf: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra "Extras" menuitem: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra-Taste: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs. exe
O9 - Extra "Extras" menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C: \ Program Files \ Messenger \ msmsgs.exe
O10 - Unknown file in Winsock LSP: c: \ windows \ system32 \ nwprovau.dll
O18 - Protocol: skype4com - (FFC8B962-9B40-4DFF-9458-1830C7DD7F5D) - C: \ PROGRA ~ 1 \ COMMON ~ 1 \ Skype \ SKYPE4 ~ 1.DLL
O20 - Winlogon Notify: DfLogon - C: \ WINDOWS \ SYSTEM32 \ LogonDll. dll
O23 - Service: Adobe LM Service - Adobe Systems - C: \ Programme \ Gemeinsame Dateien \ Adobe Systems Shared \ Service \ Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C: \ Programme \ Gemeinsame Dateien \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C: \ Program Files \ Bonjour \ mDNSResponder.exe
O23 - Service: DF5Serv - Faronics Corporation - C: \ Program Files \ Faronics \ Deep Freeze \ Install C-0 \ DF5Serv. exe
O23 - Service: GhostStartService - Symantec Corporation - C: \ Program Files \ Symantec \ Norton Ghost 2003 \ GhostStartService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C: \ Program Files \ iPod \ bin \ iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C: \ WINDOWS \ system32 \ nvsvc32.exe
O23 - Service: pml Driver HPZ12 - HP - C: \ WINDOWS \ system32 \ HPZipm12. exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C: \ Program Files \ Viewpoint \ Common \ ViewpointService.exe
--
Ende der Datei - 6115 bytes