Könntet ihr mal bitte mein log prüfen ob damit alles in ordnung ist...?!


Logfile of HijackThis v1.99.1
Scan saved at 14:30:05, on 28.01.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\system32\rlvknlg.exe
C:\Programme\MSN Messenger\msnmsgr.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Dokumente und Einstellungen\Webmaster\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe



DANKE!

Oben auf der Seite --> auf Durchsuchen klicken --> Datei aussuchen --> Doppelklick auf die zu prüfende Datei --> klick auf Submit... jetzt abwarten --> kopiere das Ergebnis in das Sicherheitsforum
http://www.virustotal.com/flash/index_en.html

c:\windows\system32\rlls.dll

ok hier ist das ergebnis:

This is a report processed by VirusTotal on 01/29/2006 at 11:07:57 (CET) after scanning the file "rlls.dll" file.

Antivirus Version Update Result
AntiVir 6.33.0.81 01.28.2006 no virus found
Avast 4.6.695.0 01.29.2006 no virus found
AVG 718 01.27.2006 no virus found
Avira 6.33.0.81 01.27.2006 no virus found
BitDefender 7.2 01.29.2006 no virus found
CAT-QuickHeal 8.00 01.27.2006 no virus found
ClamAV devel-20051123 01.28.2006 no virus found
DrWeb 4.33 01.28.2006 no virus found
eTrust-InoculateIT 23.71.62 01.28.2006 no virus found
eTrust-Vet 12.4.2058 01.27.2006 no virus found
Ewido 3.5 01.29.2006 no virus found
Fortinet 2.54.0.0 01.29.2006 suspicious
F-Prot 3.16c 01.28.2006 no virus found
Ikarus 0.2.59.0 01.27.2006 no virus found
Kaspersky 4.0.2.24 01.29.2006 no virus found
McAfee 4684 01.27.2006 potentially unwanted program Proxy-OSS
NOD32v2 1.1385 01.28.2006 no virus found
Norman 5.70.10 01.27.2006 no virus found
Panda 9.0.0.4 01.29.2006 no virus found
Sophos 4.02.0 01.29.2006 no virus found
Symantec 8.0 01.29.2006 no virus found
TheHacker 5.9.3.083 01.29.2006 no virus found
UNA 1.83 01.27.2006 no virus found
VBA32 3.10.5 01.28.2006 no virus found

http://www.file.net/prozess/rlls.dll.html
Link 2

RelevantKnowledge Description
RelevantKnowledge is an online market research service that conducts surveys on topics of interest to the Internet community. Responses to these surveys are aggregated and the results help determine the content you see when you surf. RelevantKnowledge monitors your Internet surfing, by routing your Internet activities through their service and logging information about the web pages that you visit and the actions that you take, such as the purchases and transactions you make. RelevantKnowledge can only monitor the Internet behavior and activity of your configured computers.

www.RelevantKnowledge.com

RelevantKnowledge Removal Instructions

Before you can delete files, you must first stop all the RelevantKnowledge processes that are running in memory.
Do this by ending all processes from the Task Manager.
Press CTRL+ALT+DELETE to open the Windows Task Manager. If you see multiple
"tabs," click on the "Processes" tab. For each process that you would like
to kill, find the process name in the list, click it to select it, and click
the "End Process" button.

Delete registry values Instructions:
Open the Windows Registry Editor by clicking on the Windows "Start" button,
clicking "Run," and typing "regedit" into the box in the Window that appears. Click "OK".
Once the Registry Editor is open, navigate through the registry tree to the
location of the key that you wish to delete. When you find the key or
value to be deleted, click on it to highlight it and press the "DELETE" key.

Unregister DLL Instructions:
To un-register a DLL file, first locate the file on your hard drive.
Open a command prompt window by clicking on the Windows "Start" button,
clicking "Run," and typing "cmd" into the box in the Window that appears. Click "OK."
Next type "regsvr32 /u " and press the "ENTER" key.
For example, to un-register a file called "myDll.dll" which is located in
the "C:\windows\system32" folder, your would type
"regsvr32 /u C:\windows\system32\myDll.dll" and press the "ENTER" key.
Quelle: Link 3

Link4

also was soll ich jetzt genau machen??

War eine Info für Nikita, damit sie weiß was zu tun ist. (nebenbei: Du gondelst seid einiger Zeit mit einem key-logger herum)

Cleanup
Nutze Cleanup wie beschrieben:
http://www.virus-protect.org

Arbeite das hier ab ==> Poste alle 4 Logs der letzten 3 Monate:
http://virus-protect.org/datfindbat.html

Datentr„ger in Laufwerk C: ist
Volumeseriennummer: B05D-6EB2

Verzeichnis von C:\WINDOWS\system32

29.01.2006 12:22 2 cmd.com
29.01.2006 12:22 2 taskkill.com
29.01.2006 12:22 2 regedit.com
29.01.2006 12:22 2 tracert.com
29.01.2006 12:22 2 tasklist.com
29.01.2006 12:22 2 netstat.com
29.01.2006 12:22 2 ping.com
28.01.2006 14:00 2'206 wpa.dbl
26.01.2006 13:38 926'241 model.dat
26.01.2006 13:38 53'248 silc_dll.dll
26.01.2006 13:38 729'088 LDPackage.dll <-- ? ? ?Spyware.Marketscore
26.01.2006 13:34 16'832 amcompat.tlb
26.01.2006 13:34 23'392 nscompat.tlb
26.01.2006 10:31 1'150'976 rlvknlg.exe <-- RELEVANT KNOWLEDGE
21.01.2006 15:02 229'376 cemetrix.dll <-- VX2/Better Internet
21.01.2006 15:01 8'464 sporder.dll
21.01.2006 15:01 303'104 rlls.dll
19.01.2006 21:26 1'392'670 msvbvm60.dll
15.01.2006 14:56 2'277'888 TUKernel.exe
12.01.2006 16:24 45 initdebug.nfo
12.01.2006 15:42 154'768 FNTCACHE.DAT
05.01.2006 04:41 2'836'320 MRT.exe
30.12.2005 23:14 58'952 MsgPlusLoader.dll
29.12.2005 03:54 280'064 gdi32.dll
25.12.2005 15:47 98'304 CmdLineExt.dll
25.12.2005 13:56 43'520 CmdLineExt03.dll
18.12.2005 14:23 176'167 rmoc3260.dll
18.12.2005 14:23 6'656 pndx5016.dll
18.12.2005 14:23 5'632 pndx5032.dll
18.12.2005 14:23 278'528 pncrt.dll
17.12.2005 23:30 4'212 zllictbl.dat
17.12.2005 09:37 7'006 jupdate-1.5.0_06-b05.log
17.12.2005 08:51 311'604 perfh009.dat
17.12.2005 08:51 48'156 perfc007.dat
17.12.2005 08:51 39'992 perfc009.dat
17.12.2005 08:51 316'594 perfh007.dat
17.12.2005 08:51 723'744 PerfStringBackup.INI
14.12.2005 09:24 118'784 sirenacm.dll
12.12.2005 07:44 307'200 atiiiexx.dll
12.12.2005 07:01 258'048 ATIDEMGR.dll
12.12.2005 06:09 6'684'672 atioglx1.dll
12.12.2005 04:57 4'968'448 atioglxx.dll
12.12.2005 04:41 252'928 ati2dvag.dll
12.12.2005 04:35 110'592 atipdlxx.dll
12.12.2005 04:35 77'824 Oemdspif.dll
12.12.2005 04:35 26'112 Ati2mdxx.exe
12.12.2005 04:35 40'960 ati2edxx.dll
12.12.2005 04:34 47'104 ati2evxx.dll
12.12.2005 04:33 393'216 ati2evxx.exe
12.12.2005 04:33 53'248 ATIDDC.DLL
12.12.2005 04:25 2'518'016 ati3duag.dll
12.12.2005 04:18 862'464 ativvaxx.dll
12.12.2005 04:04 151'552 atikvmag.dll
12.12.2005 03:39 17'408 atitvo32.dll
12.12.2005 03:33 237'568 ati2cqag.dll
11.12.2005 21:05 520'192 ati2sgag.exe
08.12.2005 23:01 112'421 atiicdxx.dat
05.12.2005 06:12 405'504 pxdrv.dll
05.12.2005 06:12 339'968 Px.dll
05.12.2005 06:12 61'440 pxhpinst.exe
05.12.2005 06:12 56'320 pxinsa64.exe
05.12.2005 06:12 172'032 pxmas.dll
05.12.2005 06:12 28'672 VXBLOCK.dll
05.12.2005 06:12 339'968 PxWave.dll
05.12.2005 06:12 56'832 pxcpya64.exe
01.12.2005 04:31 1'492'480 shdocvw.dll
28.11.2005 16:43 6'024 atifglpf.xml
24.11.2005 00:58 1'022'464 browseui.dll
24.11.2005 00:58 3'013'632 mshtml.dll
20.11.2005 13:58 664 d3d9caps.dat
10.11.2005 19:07 1'093'632 pxsfs.dll
10.11.2005 19:07 108'544 pxcpyi64.exe
10.11.2005 19:07 104'960 pxinsi64.exe
10.11.2005 13:03 127'078 javaws.exe
10.11.2005 13:03 49'265 jpicpl32.cpl
10.11.2005 11:27 49'250 javaw.exe
10.11.2005 11:27 49'248 java.exe
09.11.2005 22:22 261 $winnt$.inf
09.11.2005 22:20 2'951 CONFIG.NT
09.11.2005 22:19 488 WindowsLogon.manifest
09.11.2005 22:19 488 logonui.exe.manifest
09.11.2005 22:19 749 nwc.cpl.manifest
09.11.2005 22:19 749 wuaucpl.cpl.manifest
09.11.2005 22:19 749 cdplayer.exe.manifest
09.11.2005 22:19 749 sapi.cpl.manifest
09.11.2005 22:19 749 ncpa.cpl.manifest
09.11.2005 22:17 21'740 emptyregdb.dat
09.11.2005 22:14 0 h323log.txt
05.11.2005 04:16 606'208 urlmon.dll
05.11.2005 04:16 1'056'256 danim.dll

Datentr„ger in Laufwerk C: ist
Volumeseriennummer: B05D-6EB2

Verzeichnis von C:\DOKUME~1\WEBMAS~1\LOKALE~1\Temp


Datentr„ger in Laufwerk C: ist
Volumeseriennummer: B05D-6EB2

Verzeichnis von C:\WINDOWS

29.01.2006 12:30 1'233'393 WindowsUpdate.log
29.01.2006 12:30 0 0.log
29.01.2006 12:30 159 wiadebug.log
29.01.2006 12:30 50 wiaservc.log
29.01.2006 12:30 2'048 bootstat.dat
29.01.2006 12:29 32'640 SchedLgU.Txt
29.01.2006 11:49 528 win.ini
28.01.2006 14:32 227 system.ini
26.01.2006 22:01 791'344 setupapi.log
26.01.2006 13:36 22'995 wmsetup.log
26.01.2006 13:35 379 wmsetup10.log
19.01.2006 21:26 0 [INI]
17.01.2006 18:13 754 WORDPAD.INI
12.01.2006 11:50 10 WININIT.INI
11.01.2006 22:49 13'197 ocmsn.log
11.01.2006 22:49 12'448 tabletoc.log
11.01.2006 22:49 91'012 comsetup.log
11.01.2006 22:49 53'402 ntdtcsetup.log
11.01.2006 22:49 111'743 tsoc.log
11.01.2006 22:49 293'143 iis6.log
11.01.2006 22:49 1'374 imsins.log
11.01.2006 22:49 11'043 KB908519.log
11.01.2006 22:49 16'787 MedCtrOC.log
11.01.2006 22:49 11'995 msgsocm.log
11.01.2006 22:49 119'708 ocgen.log
11.01.2006 22:49 41'778 netfxocm.log
11.01.2006 22:49 234'118 FaxSetup.log
11.01.2006 22:49 79'252 msmqinst.log
08.01.2006 19:00 11'044 KB912919.log
08.01.2006 19:00 14'272 updspapi.log
30.12.2005 13:13 737'280 iun6002.exe
29.12.2005 19:43 316'640 WMSysPr9.prx
26.12.2005 23:17 295 Q321178.log
24.12.2005 13:42 4 iosecure.exp
24.12.2005 13:42 4 num41.jbd
24.12.2005 13:42 4 info147.sys
18.12.2005 13:34 314 nsw.log
17.12.2005 11:02 3'022 mozver.dat
16.12.2005 23:24 30'370 KB899587.log
16.12.2005 23:24 29'488 KB896422.log
16.12.2005 23:23 29'347 KB885835.log
16.12.2005 23:23 28'223 KB885836.log
16.12.2005 23:23 29'040 KB885250.log
16.12.2005 23:23 29'178 KB901017.log
16.12.2005 23:23 29'502 KB899591.log
16.12.2005 23:23 29'793 KB896424.log
16.12.2005 23:23 29'172 KB893756.log
16.12.2005 23:23 26'467 KB896423.log
16.12.2005 23:23 26'760 KB873339.log
16.12.2005 23:23 26'825 KB888113.log
16.12.2005 23:23 27'373 KB887742.log
16.12.2005 23:23 26'768 KB887472.log
16.12.2005 23:22 28'103 KB896358.log
16.12.2005 23:22 22'360 KB910437.log
16.12.2005 23:22 31'283 KB905915.log
16.12.2005 23:22 24'285 KB891781.log
16.12.2005 23:22 30'666 KB902400.log
16.12.2005 23:22 21'407 KB890046.log
16.12.2005 23:22 20'319 KB893066.log
16.12.2005 23:22 20'341 KB899589.log
16.12.2005 23:22 20'591 KB905414.log
16.12.2005 23:22 19'896 KB901214.log
16.12.2005 23:21 18'398 KB888302.log
16.12.2005 23:21 20'305 KB900725.log
16.12.2005 23:21 12'740 KB886185.log
16.12.2005 23:21 17'548 KB904706.log
16.12.2005 23:21 18'223 KB905749.log
16.12.2005 23:21 17'007 KB896428.log
16.12.2005 23:21 17'689 KB894391.log
16.12.2005 23:21 17'832 KB890859.log
16.12.2005 23:01 0 nsreg.dat
16.12.2005 23:01 107'132 UninstallFirefox.exe
16.12.2005 22:40 9'638 KB893803v2.log
16.12.2005 22:38 8'428 KB898461.log
16.12.2005 20:29 2'109 vminst.log
23.11.2005 22:16 183'857 setupact.log
20.11.2005 22:08 332 Directx.log
10.11.2005 21:12 1'482 chipset.log
10.11.2005 20:47 2'020 SMinstall.log
10.11.2005 19:08 390 xpsp1hfm.log
10.11.2005 15:18 179 LDM.log
10.11.2005 15:17 86 KE.log
09.11.2005 22:26 829 OEWABLog.txt
09.11.2005 22:23 8'192 REGLOCS.OLD
09.11.2005 22:20 0 control.ini
09.11.2005 22:20 4'161 ODBCINST.INI
09.11.2005 22:19 749 WindowsShell.Manifest
09.11.2005 22:17 1'023 sessmgr.setup.log
09.11.2005 22:17 37 vbaddin.ini
09.11.2005 22:17 36 vb.ini
09.11.2005 22:17 133 DtcInstall.log
09.11.2005 22:15 200 cmsetacl.log
09.11.2005 22:12 2'014 regopt.log
09.11.2005 22:11 0 Sti_Trace.log
09.11.2005 22:08 0 setuperr.log

Datentr„ger in Laufwerk C: ist
Volumeseriennummer: B05D-6EB2

Verzeichnis von C:\

29.01.2006 12:52 0 sys.txt
29.01.2006 12:52 6'658 system.txt
29.01.2006 12:51 124 systemtemp.txt
29.01.2006 12:51 96'529 system32.txt
29.01.2006 12:30 2'145'386'496 pagefile.sys
28.01.2006 14:32 389 boot.ini
09.11.2005 22:20 0 AUTOEXEC.BAT
09.11.2005 22:20 0 IO.SYS
09.11.2005 22:20 0 MSDOS.SYS
09.11.2005 22:20 0 CONFIG.SYS

LSPfix
http://www.spychecker.com/program/lspfix.html

hake an: "I know what Im doing"--Remove
und loesche die rlls.dll
(eventuell musst du die dll von links nach rechts bringen)

Start-->Ausfuehren--> cmd
kopiere rein:

NSCheck /uninstall

---------------------------------------------------------------------------
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren:

C:\WINDOWS\system32\model.dat
C:\WINDOWS\system32\silc_dll.dll
C:\windows\system32\LDPackage.dll
C:\windows\system32\Downloaded Program Files\setup.exe
C:\windows\system32\opnsqr.exe
C:\windows\system32\cosscfg.exe
C:\WINDOWS\system32\rlvknlg.exe
C:\WINDOWS\system32\cemetrix.dll
C:\WINDOWS\system32\sporder.dll

C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\tracert.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\iosecure.exp
C:\WINDOWS\num41.jbd
C:\WINDOWS\info147.sys
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\[INI]
C:\WINDOWS\iun6002.exe
C:\WINDOWS\system32\amcompat.tlb
C:\WINDOWS\system32\nscompat.tlb

PC neustarten

ewido (scanne und kopiere hier den scanreport
http://virus-protect.org/ewido.html

Info:Spyware.Marketscore
http://securityresponse.symantec.com/av ... score.html

---------------------------------------------------------
ewido anti-malware - Scan Report
---------------------------------------------------------

+ Erstellt am: 14:23:23, 29.01.2006
+ Report-Checksumme: 78B66835

+ Scanergebnis:

HKLM\SOFTWARE\Classes\WUSN.1 -> Spyware.SaveNow : Gesäubert mit Backup
:mozilla.35:C:\Dokumente und Einstellungen\Webmaster\Anwendungsdaten\Mozilla\Firefox\Profiles\6sreulps.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.36:C:\Dokumente und Einstellungen\Webmaster\Anwendungsdaten\Mozilla\Firefox\Profiles\6sreulps.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.37:C:\Dokumente und Einstellungen\Webmaster\Anwendungsdaten\Mozilla\Firefox\Profiles\6sreulps.default\cookies.txt -

::Report Ende

was muss ich sonst noch machen???

http://virus-protect.org/artikel/bfu/p2pbfuhtml.html
arbeite das ab (ohne den ewido...das hast du ja schon gemacht)

dann sollte wieder alles in Ordnung sein

ok hab ich gemacht poste hier zu meiner sicherheit noch einmal das hijackthis log...!?

Logfile of HijackThis v1.99.1
Scan saved at 17:02:17, on 29.01.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\MessengerPlus! 3\MsgPlus.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Webmaster\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Programme\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe



danke!

ist damit jetzt alles ok??

wenn du keine popups mehr meldest und zufrieden bist...dann ist alles o.k.