What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please check my hijackthis log

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi!
I have done a spybot scan and fix as well as an adware scan and fix, but there is still some "strange" stuff happening……the file lckotflnu.exe wants internet access and I can't get it removed. It keeps on "returning"……it would be great, if someone could check my hijackthis log - I don't understand it. :)

Thanks a lot!

Logfile of HijackThis v1.99.0
Scan saved at 19:24:15, on 01.08.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\System32\DSentry.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
c:\windows\system32\efjdqo.exe
C:\Programme\Unimessage Pro\WilCap.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\AOL 9.0\aoltray.exe
C:\Programme\ComCenter\IWatch.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLacsd.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Programme\AOL 9.0\waol.exe
C:\Programme\AOL 9.0\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE
C:\Dokumente und Einstellungen\Nicole Stahl\Eigene Dateien\HijackThis.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.momente.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\dokumente und einstellungen\momente\homepage\editor-software\ftp_programm\wsbho2K0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)
O4 - HKLM\..\Run: [StorageGuard] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EumexInst] "D:\Setup.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HDAudio Driver 1.0] C:\WINDOWS\system32\dvuzdl.exe
O4 - HKLM\..\Run: [HDAudio Driver 2.0] C:\WINDOWS\system32\ppfvtbud.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [inlvncd] c:\windows\system32\efjdqo.exe r
O4 - HKCU\..\Run: [WilSpoolProxy] C:\Programme\Unimessage Pro\WilCap.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe
O4 - Global Startup: ISDNWatch.lnk = C:\Programme\ComCenter\IWatch.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120480513140
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/def…geUploader3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{31DA5040-33F1-4F26-9063-89A4EB2A4136}: NameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CFFDFB7-CBA8-4A60-92AD-C7FCD7A0D8E4}: NameServer = 192.168.121.252,192.168.121.253
O17 - HKLM\System\CS1\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Privacy Protection Service - Unknown - C:\Programme\Gemeinsame Dateien\AOL\AOL Privacy Protection\\aolserv.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: AVM FRITZ!web Routing Service - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InCD Helper - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: ISSvc - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService - Intel® Corporation - C:\Programme\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service - Unknown - c:\windows\SvcProc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
We are sorry for the delay in replying to you.

If you still require help, please Update to HijackThis 1.99.1.
  • Open HijackThis and click config.. < Misc. Tools, scroll down and click Check for Update Online.
Post a fresh Hijackthis log as a reply to this thread.

I'll receive an e-mail notification of your reply and will respond as soon as possible.

Thank you for your patience.
Post #3
Hi Alan!
Thanks for your response!
My problems haven't been solved yet. I still can't get rid of this lckotflnu.exe file and it keeps getting more insistent. Every removal I have tried, deletes it for a moment, but it keeps coming back. :(

It would be great, if you could check my highjackthis log again - I have updated the version! Thanks a lot!!!

Nicole

Logfile of HijackThis v1.99.1
Scan saved at 09:58:28, on 15.08.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\System32\DSentry.exe
C:\WINDOWS\system32\ormgak.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Unimessage Pro\WilCap.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\AOL 9.0\aoltray.exe
C:\Programme\ComCenter\IWatch.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLacsd.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\AOL 9.0\waol.exe
C:\Programme\AOL 9.0\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE
C:\Programme\Gemeinsame Dateien\AOL\AOL Privacy Protection\ASP.exe
C:\Programme\Messenger\msmsgs.exe
C:\Dokumente und Einstellungen\Nicole Stahl\Eigene Dateien\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.momente.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\dokumente und einstellungen\momente\homepage\editor-software\ftp_programm\wsbho2K0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)
O4 - HKLM\..\Run: [StorageGuard] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EumexInst] "D:\Setup.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HDAudio Driver 1.0] C:\WINDOWS\system32\dvuzdl.exe
O4 - HKLM\..\Run: [HDAudio Driver 2.0] C:\WINDOWS\system32\ppfvtbud.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [fxmltbh] C:\WINDOWS\system32\ormgak.exe r
O4 - HKCU\..\Run: [WilSpoolProxy] C:\Programme\Unimessage Pro\WilCap.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe
O4 - Global Startup: ISDNWatch.lnk = C:\Programme\ComCenter\IWatch.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120480513140
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp02.photoprintit.de/microsite/324…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{31DA5040-33F1-4F26-9063-89A4EB2A4136}: NameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CFFDFB7-CBA8-4A60-92AD-C7FCD7A0D8E4}: NameServer = 192.168.121.252,192.168.121.253
O17 - HKLM\System\CS1\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Privacy Protection Service (AOLService) - Unknown owner - C:\Programme\Gemeinsame Dateien\AOL\AOL Privacy Protection\\aolserv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Programme\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #4
Hello Nicole and welcome to TomCoyote. :wavey:
  • Install and Update Ewido:
    • Download and install Ewido security suite.
    • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
    • Launch Ewido, there should be an icon on your desktop for it to double-click.
      • The program will prompt you to update, click the OK button.
      • The program will now go to the main screen.
    • You will need to update ewido to the latest definition files.
      • On the left hand side of the main screen click update.
      • Click on Start Update.
      • The update will start and a progress bar will show the updates being installed.
    • Once the updates are installed, close the program.
  • Download CCleaner and install, but do not run it yet.
  • Please download Nailfix.
    • Please do NOT run it yet.

Reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml


  • Run Nailfix.
    • Once in Safe Mode, please double-click on Nailfix.exe.
    • Click "Next" in the setup, then make sure "Run Nailfix" is checked and click "Finish".
      Your desktop and icons will disappear and reappear, and a window should open and close very quickly — this is normal.
  • Scan with Ewido.
    • Launch Ewido again.
      • Click on scanner
      • Click on Complete System Scan and the scan will begin.
      • While the scan is in progress you will be prompted to clean files, click OK
      • When it asks if you want to clean the first file, put a check in the lower left corner of the boxes that say "Perform action on all infections"and "Create encrypted backup" then choose clean and click OK.
      • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
      • Click Save report.
      • Save the report .txt file to your desktop.
    • Now close ewido security suite.
  • Fix with HijackThis
    • Next please run HijackThis, click Scan, and check the following (if still present):

      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

      O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\system32\richedtr.dll (file missing)

      O4 - HKLM\..\Run: [EumexInst] "D:\Setup.exe"
      O4 - HKLM\..\Run: [HDAudio Driver 1.0] C:\WINDOWS\system32\dvuzdl.exe
      O4 - HKLM\..\Run: [HDAudio Driver 2.0] C:\WINDOWS\system32\ppfvtbud.exe
      O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
      O4 - HKLM\..\Run: [fxmltbh] C:\WINDOWS\system32\ormgak.exe r

      O16 - DPF: {D7BF3304-138B-4DD5-86EE-491BB6A2286C} - http://www.azebar.com/install/azesearch.cab
    • Close all other programs and browsers and click Fix Checked.
  • Delete Files/Folders
    • While still in Safe mode, delete the following files:

      C:\WINDOWS\system32\dvuzdl.exe
      C:\WINDOWS\system32\ppfvtbud.exe
      C:\WINDOWS\system32\richup.exe
      C:\WINDOWS\system32\ormgak.exe
  • Now, run CCleaner.
    • Uncheck "Cookies" under "Internet Explorer".
    • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
    • Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.
  • Restart your computer in normal mode and post a new HijackThis log, as well as the log from the Ewido scan.
Post #5
Hi Alan!

Wow! That was a fast reply - thanks a lot. Well, I hope I did everything right. Here is the new highjackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 16:46:51, on 15.08.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe
C:\Programme\QuickTime\qttask.exe
C:\WINDOWS\System32\DSentry.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe
C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programme\Analog Devices\SoundMAX\Smax4.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Unimessage Pro\WilCap.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Programme\AOL 9.0\aoltray.exe
C:\Programme\ComCenter\IWatch.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\Programme\ewido\security suite\ewidoctrl.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\AOL 9.0\waol.exe
C:\Programme\AOL 9.0\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\Dokumente und Einstellungen\Nicole Stahl\Eigene Dateien\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.momente.biz/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - c:\dokumente und einstellungen\momente\homepage\editor-software\ftp_programm\wsbho2K0.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [StorageGuard] "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Programme\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [WilSpoolProxy] C:\Programme\Unimessage Pro\WilCap.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Programme\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = C:\Programme\AOL 9.0\aoltray.exe
O4 - Global Startup: ISDNWatch.lnk = C:\Programme\ComCenter\IWatch.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120480513140
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game11.zylomgames.com/activex/zylomloader.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp02.photoprintit.de/microsite/324…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{31DA5040-33F1-4F26-9063-89A4EB2A4136}: NameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CFFDFB7-CBA8-4A60-92AD-C7FCD7A0D8E4}: NameServer = 192.168.121.252,192.168.121.253
O17 - HKLM\System\CS1\Services\Tcpip\..\{2B6C2C57-9709-4E9B-975C-5BC395DA39F9}: NameServer = 205.188.146.145
O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Privacy Protection Service (AOLService) - Unknown owner - C:\Programme\Gemeinsame Dateien\AOL\AOL Privacy Protection\\aolserv.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Programme\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

and the Ewido scan:
———————————————————
ewido security suite - Scan Report
———————————————————

+ Erstellt am: 13:23:38, 15.08.2005
+ Report-Checksumme: 352F4854

+ Scanergebnis:

[832] C:\WINDOWS\system32\eeemhck.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\data -> TrojanDownloader.IstBar.kc : Gesäubert mit Backup
:mozilla.6:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.7:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.8:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.9:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.14:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.15:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.16:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.17:C:\Dokumente und Einstellungen\Nicole Stahl\Anwendungsdaten\Mozilla\Firefox\Profiles\1ykxvn2u.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole stahl@2o7[1].txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole stahl@abetterinternet[2].txt -> Spyware.Cookie.Abetterinternet : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole [removed][1].txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole [removed][1].txt -> Spyware.Cookie.Esomniture : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole [removed][2].txt -> Spyware.Cookie.Esomniture : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole stahl@ivwbox[1].txt -> Spyware.Cookie.Ivwbox : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Cookies\nicole stahl@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Lokale Einstellungen\Temp\drp6D.tmp\thnall5c.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\Dokumente und Einstellungen\Nicole Stahl\Lokale Einstellungen\Temp\WKA\aurareco.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP293\A0083161.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP293\A0083202.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP295\A0083428.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP297\A0083721.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP297\A0083752.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP300\A0084146.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP300\A0084161.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP300\A0084162.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP300\A0084177.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP300\A0084198.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084275.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084276.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084301.exe -> Spyware.Hijacker.Generic : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084369.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084374.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084375.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP301\A0084386.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084470.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084471.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084495.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084510.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084511.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084533.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084534.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084546.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084547.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP302\A0084570.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084600.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084601.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084624.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084627.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084646.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084647.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084670.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084681.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP303\A0084682.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084706.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084733.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084734.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084757.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084789.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084790.exe -> Trojan.Agent.cp : Gesäubert mit Backup
C:\System Volume Information\_restore{0FF17727-9F83-4D7C-919C-3A3EAC40F985}\RP304\A0084791.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\WINDOWS\lckotflnu.exe -> Adware.BetterInternet : Gesäubert mit Backup
C:\WINDOWS\SYSTEM32\eeemhck.exe -> Trojan.Agent.cp : Gesäubert mit Backup


::Report Ende
Post #6
Your new log appears clean. :)

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.
Post #7
Hi Alan! Thanks a lot for your help! So far, I haven't had any weird popups! :D I have already changed my internet browser to firefox, since friends told me that it's safer than the internet explorer. However, since a couple of days ago, it's not working anymore. No webpages are shown - only the message that "the site doesn't include any data". Whatever that means. But I'm sure I will get that figured out one of these days. Thanks a lot for all your help and good advice!!!!! That was really great - especially for a computer dummy like me! Best wishes from Germany!!!! B) Nicole
Post #8
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI