Kann das mal jemand kontrollieren?

danman23 · 13.12.2004, 23:13

Hallo ich wäre froh wenn sich jemand mal mein Logfile zur Kontrolle anschauen könnte ich kann damit nicht viel anfangen aber ich bin
sicher irgendwas is nicht sauber...
Im vornherein schon mal danke

Logfile of HijackThis v1.97.7
Scan saved at 22:20:55, on 13.12.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\Explorer.EXE
E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
E:\Programme\QuickTime\qttask.exe
E:\Programme\Messenger Plus! 3\MsgPlus.exe
E:\Programme\SED\SED.exe
E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
E:\Programme\Lexmark X1100 Series\lxbkbmon.exe
E:\PROGRA~1\eScan\TRAYICOS.EXE
E:\PROGRA~1\eScan\AVPMWrap.EXE
E:\WINDOWS\System32\ctfmon.exe
E:\PROGRA~1\eScan\MAILDISP.EXE
E:\Programme\MSN Messenger\msnmsgr.exe
E:\PROGRA~1\eScan\MAILSCAN.EXE
E:\PROGRA~1\eScan\SPOOLER.EXE
E:\Programme\AVPersonal\AVWUPSRV.EXE
E:\PROGRA~1\eScan\TRAYSSER.EXE
E:\PROGRA~1\eScan\avpm.exe
E:\WINDOWS\System32\svchost.exe
E:\PROGRA~1\eScan\kavss.exe
E:\PROGRA~1\eScan\AvpM.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\wuauclt.exe
E:\Programme\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\taskmgr.exe
E:\WINDOWS\regedit.com
F:\L&H Power Translator Pro\ptpro.exe
E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe"
O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: eBay - Homepage (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe

chaosman · 13.12.2004, 23:15

@danman23
bitte poste ein HJT logfile der aktuellen version
http://www.hijackthis.de/

chaosman

Passat2002 · 13.12.2004, 23:19

Zitat:

Zitat von chaosman

@danman23
bitte poste ein HJT logfile der aktuellen version
http://www.hijackthis.de/

chaosman

von wo kommen plötzlich die vielen 1.97.7 versionen her ??

chaosman · 13.12.2004, 23:21

@Passat2002
viellicht haben die den keller aufgeräumt... :aplaus:

chaosman

danman23 · 13.12.2004, 23:32

Wow hätte nicht gedacht das das so schnell geht.
Hier die neue Logfile:

Logfile of HijackThis v1.97.7
Scan saved at 23:29:44, on 13.12.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\Explorer.EXE
E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
E:\Programme\QuickTime\qttask.exe
E:\Programme\Messenger Plus! 3\MsgPlus.exe
E:\Programme\SED\SED.exe
E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
E:\Programme\Lexmark X1100 Series\lxbkbmon.exe
E:\PROGRA~1\eScan\TRAYICOS.EXE
E:\PROGRA~1\eScan\AVPMWrap.EXE
E:\WINDOWS\System32\ctfmon.exe
E:\PROGRA~1\eScan\MAILDISP.EXE
E:\Programme\MSN Messenger\msnmsgr.exe
E:\PROGRA~1\eScan\MAILSCAN.EXE
E:\PROGRA~1\eScan\SPOOLER.EXE
E:\Programme\AVPersonal\AVWUPSRV.EXE
E:\PROGRA~1\eScan\TRAYSSER.EXE
E:\PROGRA~1\eScan\avpm.exe
E:\WINDOWS\System32\svchost.exe
E:\PROGRA~1\eScan\kavss.exe
E:\PROGRA~1\eScan\AvpM.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\wuauclt.exe
E:\Programme\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\taskmgr.exe
E:\WINDOWS\regedit.com
F:\L&H Power Translator Pro\ptpro.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe"
O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: eBay - Homepage (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe

danman23 · 13.12.2004, 23:40

äh sorry da hab ichs doch glatt nochmal vergeigt

das sollte jetz das neue Log-File sein:
Logfile of HijackThis v1.98.2
Scan saved at 23:37:37, on 13.12.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\LEXPPS.EXE
E:\WINDOWS\Explorer.EXE
E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
E:\Programme\QuickTime\qttask.exe
E:\Programme\Messenger Plus! 3\MsgPlus.exe
E:\Programme\SED\SED.exe
E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe
E:\Programme\Lexmark X1100 Series\lxbkbmon.exe
E:\PROGRA~1\eScan\TRAYICOS.EXE
E:\PROGRA~1\eScan\AVPMWrap.EXE
E:\WINDOWS\System32\ctfmon.exe
E:\PROGRA~1\eScan\MAILDISP.EXE
E:\Programme\MSN Messenger\msnmsgr.exe
E:\PROGRA~1\eScan\MAILSCAN.EXE
E:\PROGRA~1\eScan\SPOOLER.EXE
E:\Programme\AVPersonal\AVWUPSRV.EXE
E:\PROGRA~1\eScan\TRAYSSER.EXE
E:\PROGRA~1\eScan\avpm.exe
E:\WINDOWS\System32\svchost.exe
E:\PROGRA~1\eScan\kavss.exe
E:\PROGRA~1\eScan\AvpM.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\wuauclt.exe
E:\Programme\Internet Explorer\iexplore.exe
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\System32\taskmgr.exe
E:\WINDOWS\regedit.com
F:\L&H Power Translator Pro\ptpro.exe
E:\WINDOWS\system32\NOTEPAD.EXE
E:\WINDOWS\notepad.exe
E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe"
O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App
O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE
O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - E:\Programme\IrfanView\Ebay\Ebay.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\MSMSGS.EXE
O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing
O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe

Cidre · 14.12.2004, 00:04

Warum eröffnest du einen sinnlosen zweiten Thread?!

Wechsle in den abgesicherten Modus http://www.bsi.bund.de/av/texte/wiederher_xp.htm und fixe diese Einträge (Haken setzen und auf Fix Checked klicken):

Alle R0, R1 und R3
Alle O1
O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe"
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab
O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe

Diese Ordner löschen:
E:\Programme\SED
E:\PROGRA~1\VBOUNCER

- mit eScan scannen
- neue Startseite vergeben
- Neustart
- dein System updaten http://v5.windowsupdate.microsoft.co...r/default.aspx
- IE sicherer konfigurieren und nur noch für das Windows Update benutzen http://www.datenschutzzentrum.de/sel...sie/config.htm oder http://www.blafusel.de/ie.html
- Sichere und komfortablere Browser wie z.B. Mozilla oder Firefox verwenden http://www.mozilla.org
- neues Log-File von HijackThis und die Virus Log Information von eScan posten

danman23 · 14.12.2004, 00:17

Danke für die schnelle Hilfe!
sorry wegen des 2.Threads

Kann das mal jemand kontrollieren?

Log-Analyse und Auswertung: Kann das mal jemand kontrollieren?