Logfile of HijackThis v1.99.0
Scan saved at 22:48:32, on 24.03.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Microsoft IntelliType Pro\type32.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\TELES\skyDSL\tskyclnt.exe
C:\Programme\TELES\skyDSL\tkpclnt.exe
C:\Programme\TELES\skyDSL PCI\DVBData.exe
C:\Programme\TELES\skyDSL\Proxy\craxy.exe
C:\Programme\TELES\skyDSL\tskymtpc.exe
C:\Programme\TELES\skyDSL\tkpsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Meine Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Meine Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Meine Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Meine Programme\eMule\emule.exe
C:\Meine Programme\BitTorrent\bittorrent.exe
C:\DOKUME~1\Stefan\LOKALE~1\Temp\Rar$EX00.032\HijackThis.exe
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Meine Programme\iMesh\iMeshBHO.dll
O2 - BHO: My Search BHO - {014DA6C1-189F-421a-88CD-07CFE51CFF10} - C:\Programme\MySearch\bar\1.bin\S4BAR.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: iMesh Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\Programme\MySearch\bar\1.bin\S4BAR.DLL
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] REM C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Meine Programme\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [POINTER] REM point32.exe
O4 - HKLM\..\Run: [type32] "C:\Programme\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [skyDSLClient] C:\Programme\TELES\skyDSL\tskyclnt.exe -q
O4 - HKLM\..\Run: [Koppelpuls Client] C:\Programme\TELES\skyDSL\tkpclnt.exe -skydsl
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [avgnt] "C:\Meine Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Meine Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: BitTorrent.lnk = C:\Meine Programme\BitTorrent\bittorrent.exe
O4 - Startup: DVB Data Control (Budget).lnk = C:\Programme\TELES\skyDSL PCI\DVBData.exe
O4 - Global Startup: DVB Data (skyDSL PCI).lnk = C:\Programme\TELES\skyDSL PCI\DVBData.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Meine Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Meine Programme\ICQLite\ICQLite.exe
O9 - Extra button: skyDSL++ - {F7522CA2-3DDA-11d3-8560-0060977792B1} - C:\Programme\TELES\skyDSL\sky2sky.exe
O9 - Extra button: skyDSL- - - {F7522CA8-3DDA-11d3-8560-0060977792B1} - C:\Programme\TELES\skyDSL\sky2fon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\skysocks.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler - Avira GmbH - C:\Meine Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service - AVIRA GmbH - C:\Meine Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: skyDSL-Proxy - TELES Wireless Broadband Internet GmbH, Berlin - C:\Programme\TELES\skyDSL\Proxy\craxy.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
@shodan:
Wo kann ich meine IPv überprüfen?
edit:
Im Security Task Manager bekommt die Datei ein Rating von 30 (also eher gering; wie durchschnittlich alle System-Prozesse)
Bei "enthaltende Texte" stand folgendes:
This program cannot be run in DOS mode.
TCPSVCS Failed to start control dispatcher lu
TCPSVCS SetServiceStatus error ld
TCPSVCS RegisterServiceCtrlHandler failed d
TCPSVCS Cant unload DLL ws ld
TCPSVCS Cant find entry s in DLL ws ld
TCPSVCS Failed to load DLL ws ld
TCPSVCS Failed to get system directory ld
runtime error
TLOSS error
DOMAIN error
This application has requested the Runtime to terminate it in an unusual way.Please contact the applications support team for more information.
Microsoft Visual C
Runtime Error
program name unknown
HeapReAlloc LCMapStringA
Microsoft Corporation
TCP/IP Services Application
[...]
Könnte das der Grund sein?
Ist nur eine Vermutung?
mfg