hi, ich hänge hier vor dem rechner von freunden und suche den übeltäter, der die kiste ausbremst. was sagt mir dieses logfile? bin für jeden tipp sehr dankbar!

gruss, melanie

Logfile of HijackThis v1.99.1
Scan saved at 13:57:29, on 02.03.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\Lexmark X74-X75\lxbbbmgr.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Programme\AVPersonal\AVSched32.EXE
C:\Programme\Lexmark X74-X75\lxbbbmon.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\CASIO\Pocket Sheet Sync\PSXLTRAY.EXE
C:\WINDOWS\System32\rant.exe
C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Programme\Ulead Systems\Ulead PhotoImpact 5 Bundled Edition\Abmtsr.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Dokumente und Einstellungen\Melanie\Eigene Dateien\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Programme\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Programme\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [rant] rant.exe
O4 - HKLM\..\Run: [McAfee Antivirus Protection] mcafeeAV.exe
O4 - HKLM\..\RunServices: [Microsofts MediaScope] winmep.exe
O4 - HKLM\..\RunServices: [rant] rant.exe
O4 - HKLM\..\RunServices: [McAfee Antivirus Protection] mcafeeAV.exe
O4 - HKLM\..\RunServices: [Microsoft MediaScope] winmes.exe
O4 - HKCU\..\Run: [YAW starten] "c:\programme\yaw 3.5\fast.exe"
O4 - HKCU\..\Run: [Pocket Sheet Sync] C:\Programme\CASIO\Pocket Sheet Sync\PSXLTRAY.EXE
O4 - HKCU\..\Run: [rant] rant.exe
O4 - HKCU\..\Run: [McAfee Antivirus Protection] mcafeeAV.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Programme\Ulead Systems\Ulead PhotoImpact 5 Bundled Edition\Abmtsr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: MedionShop - {A17A3B51-249A-49B7-BBE6-C07847176EE4} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1098343768265
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

was sind/tun windows-prefetches? (.pf)

gruss, melanie

Zitat von melanie33

C:\WINDOWS\System32\rant.exe

O4 - HKLM\..\Run: [rant] rant.exe

O4 - HKLM\..\RunServices: [rant] rant.exe

Das sieht nicht gut aus.

Zitat Sophos:

W32/Rbot-VN is a worm with backdoor Trojan functionality.

W32/Rbot-VN is capable of spreading to computers on the local network protected by weak passwords after receiving the appropriate backdoor command.

W32/Rbot-VN will attempt to spread by exploiting the following vulnerabilities:

DCOM (MS04-012)
LSASS (MS04-011)

When first run, W32/Rbot-VN copies itself to the Windows system folder as RANT.EXE and runs this copy of the worm. The copy will then attempt to delete the original file. In order to run each time a user logs in, W32/Rbot-VN will set the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
rant
rant.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
rant
rant.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
rant
rant.exe

The worm runs continuously in the background providing backdoor access to the infected computer over IRC channels.

W32/Rbot-VN will alter the following registry entries in order to disable DCOM and close restrictions on IPC$ shares:

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
1

W32/Rbot-VN is capable of altering the following registry entry to restrict anonymous enumeration of SAM accounts:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\restrictanonymousSAM

W32/Rbot-VN can add and delete network shares and users on the infected computer. The worm can also change the network logon rights of accounts in the local system policy.