guten tag!

ich habe echt einige probleme mit meinem computer,das wohl penetranteste is dieser websiteviewer.also ich hab hier mal ne logfile,kenn mich gar nich aus mit dem kram und hoffe ich kann noch was retten.danke schonmal


Logfile of HijackThis v1.99.1
Scan saved at 22:13:37, on 14.04.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\DOKUME~1\Manu\LOKALE~1\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://213.159.117.134/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qqgdb.dll/sp.html#10213
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [AHQInit] C:\Programme\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Programme\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [addin.exe] C:\WINDOWS\system32\addin.exe
O4 - HKLM\..\Run: [LanGuard] "C:\WINDOWS\languard.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SysTime] C:\WINDOWS\system32\systime.exe
O4 - HKLM\..\Run: [0190 Warner] C:\PROGRA~1\0190WA~1\WARN0190.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [System Update4] c:\dokume~1\manu\anwend~1\svchost.exe
O4 - HKCU\..\Run: [SysTime] C:\WINDOWS\system32\systime.exe
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\WINDOWS\System32\crt32_v2.dll
O9 - Extra button: Microsoft® JavaScript® Console - {A42F4CC3-94C1-41B0-A556-CCC9F6B14639} - C:\WINDOWS\System32\jsconsole.dll
O9 - Extra 'Tools' menuitem: JavaScript Console - {A42F4CC3-94C1-41B0-A556-CCC9F6B14639} - C:\WINDOWS\System32\jsconsole.dll
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\WINDOWS\System32\crt32_v2.dll (HKCU)
O9 - Extra button: Microsoft® JavaScript® Console - {A42F4CC3-94C1-41B0-A556-CCC9F6B14639} - C:\WINDOWS\System32\jsconsole.dll (HKCU)
O9 - Extra 'Tools' menuitem: JavaScript Console - {A42F4CC3-94C1-41B0-A556-CCC9F6B14639} - C:\WINDOWS\System32\jsconsole.dll (HKCU)
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 213.159.117.202
O15 - Trusted IP range: 213.159.117.202 (HKLM)
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\mfcqq32.exe
O23 - Service: 0190/0900 Warner Überwachungsdienst (0190_0900_Warner_MonitorService) - Mirko Böer - C:\PROGRA~1\0190WA~1\w0svc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Führe escan wie hier beschrieben aus.Bitte die Anleitung genau befolgen:

http://www.trojaner-info.de/hijacker/escan

Bitte im abgesicherten Modus scannen
Häckchen müssen wie folgt gesetzt sein:





Teile uns dann das Ergebnis des eScan mit: welche Viren wurden auf Deinem Rechner gefunden: "öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." (Zitat Cidre)

Ergänzung zu cronos :

Es sieht stark danach aus, als müßte Dein System neu aufgesetzt werden, wenn ich das richtig interpretiere, aber man möchte halt auf Nummer sicher gehen, denn der Schwerpunkt worauf sich die Vermutung stützt, liegt bei :

O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\mfcqq32.exe

über dies hast Du das hier auch drauf :

http://www.sophos.de/virusinfo/analy...startpade.html

Also scannen und uns mitteilen, was los ist...

Gruß
Andy

P.S.: Hi cronos

also danke euch erstmal für die schnelle beantwortung,das mit dem escan hab ich alles hingekriegt,hat aber ne weile gedauert.wenn ich mir das so ansehe fang ich an mir ernsthaft sorgen zu machen.....aslo gut ihr wolltet es nicht anders:


Sat Apr 16 15:04:14 2005 => File C:\WINDOWS\system32\addin.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus. Action Taken: No Action Taken.
Sat Apr 16 15:04:14 2005 => File C:\WINDOWS\languard.exe infected by "Trojan-Downloader.Win32.Agent.fn" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\systime.exe infected by "Trojan.Win32.StartPage.pu" Virus. Action Taken: No Action Taken.
File c:\dokume~1\manu\anwend~1\svchost.exe infected by "Trojan.Win32.Dialer.am" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\mfcqq32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken.
System found infected with Bargain Buddy Spyware/Adware ({014da6c4-189f-421a-88cd-07cfe51cff10})! Action taken: No Action Taken.
File System Found infected by "Bargain Buddy Spyware/Adware" Virus. Action Taken: No Action Taken.
System found infected with mysearch Spyware/Adware! Action taken: No Action Taken.
File System Found infected by "mysearch Spyware/Adware" Virus. Action Taken: No Action Taken.
System found infected with myway Spyware/Adware! Action taken: No Action Taken.
File System Found infected by "myway Spyware/Adware" Virus. Action Taken: No Action Taken.
System found infected with WebSiteViewer Spyware/Adware! Action taken: No Action Taken.
File System Found infected by "WebSiteViewer Spyware/Adware" Virus. Action Taken: No Action Taken.
System found infected with sw Spyware/Adware! Action taken: No Action Taken.
File System Found infected by "sw Spyware/Adware" Virus.
System found infected with se Spyware/Adware!
File System Found infected by "se Spyware/Adware" Virus.
System found infected with hsa Spyware/Adware!
File System Found infected by "hsa Spyware/Adware" Virus.
System found infected with peopleonpage Spyware/Adware (load.exe)
File System Found infected by "peopleonpage Spyware/Adware" Virus
File C:\WINDOWS\abvpp.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus.
File C:\WINDOWS\addao.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\addii32.exe infected by "Backdoor.Win32.Small.dc" Virus.
C:\WINDOWS\addye.exe infected by "Trojan-Downloader.Win32.Agent.ap" Virus
C:\WINDOWS\apiba32.exe infected by "Backdoor.Win32.Small.dc" Virus.
C:\WINDOWS\apiln.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus.
File C:\WINDOWS\apiop32.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\apirb.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\appjg.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\appkc32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\applz.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\appxc.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\atlag32.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\atlcn32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\atlqy32.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\atlus32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\bgufk.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\bgwpw.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\crce.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\crpj.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\crpl32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\crrs32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\d3ao32.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\d3pc32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\d3tg32.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\d3uj32.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\d3vc.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\d3xq.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\gltay.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\gpjxw.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\hsqgf.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\hzoze.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\ieuy32.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\infdx.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\ipba.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\ipij.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\ipqe32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\ipru.exe infected by "Backdoor.Win32.Small.dc" Virus
File C:\WINDOWS\ipxh32.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\ipyh.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus
File C:\WINDOWS\javawx.dll infected by "Trojan-Downloader.Win32.WinShow.ai" Virus
File C:\WINDOWS\kogtx.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\lbgnz.dll infected by "not-a-virus:AdWare.SearchPage" Virus
File C:\WINDOWS\lcdub.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\lplqx.dll infected by "not-a-virus:AdWare.SearchPage" Virus
File C:\WINDOWS\mfeez.dll infected by "not-a-virus:AdWare.SearchPage" Virus
File C:\WINDOWS\mhoms.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\mshp.dll infected by "Trojan-Downloader.Win32.WinShow.ak" Virus
File C:\WINDOWS\mswg.exe infected by "Trojan-Downloader.Win32.Agent.al" Virus
File C:\WINDOWS\msyi32.exe infected by "Trojan.Win32.Agent.bi" Virus
File C:\WINDOWS\netcom.exe infected by "Trojan-Downloader.Win32.Agent.bc" Virus
File C:\WINDOWS\netkz.exe infected by "Trojan.Win32.Agent.bi" Virus


ok,also bevor ich mir jetzt noch die finger wund schreibe:escan hat glaub ich 800 viren gefunden oder so,bevor ich die jtz alle abschreibe,vielleicht könnt ihr mir ja jetzt schon sagen ob noch was zu retten ist und wenn nich ob ich das mit dem system neu aufsetzen auch hinbekomm?!

Hi,

die restlichen Funde, sind nicht notwendig, das was wir hie rgesehen haben, hat unseren Verdacht bestätigt.

Es empfehlt sich das System KOMPLETT neu aufzusetzen wie es in der Anleitung in meiner Signatur steht !!! Und danach umgehenst ALLE Passwörter zu ändern !!

Etwas anderes wäre absolut sinnlos !!!

Gruß
Andy

ja vielen dank ne, also ich hoffe das wird was und alles neu installieren muss ich ja dann auch ne also programme usw..

ok,ich geb mein bestes danke