ich hab ein problem mit dem oben genannten trojaner. ich lösche ihn immer wieder mit antivir aber er kommt dauernd wieder. hier mal die HijackThis logfile

Logfile of HijackThis v1.99.1
Scan saved at 13:40:06, on 24.09.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Programme\Logitech\MouseWare\system\em_exec.exe
E:\...\pcsuite\NOKIAP~1\TRAYAP~1.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
E:\...\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
E:\Firefox\firefox.exe
C:\Dokumente und Einstellungen\...\Desktop\...\Neuer Ordner\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\michi\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SpybotSnD] "E:\...\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CloneCDTray] "E:\...\clonecd\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\...\pcsuite\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\...\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download Flash with Flash Capture - E:\...\Flash Capture\dl.htm
O8 - Extra context menu item: Download with GetRight - E:\...\GetRight\GRdownload.htm
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - E:\...\GetRight\GRbrowse.htm
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122027214281
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE

hoffe ihr könnt mir helfen
_____________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB

Hallo,
kann ausser das SP2 fehlt nichts negatives an deinem Log erkennen. Wo(genauer Pfad) findet Antivir den Trojaner?


Grüße Wildone

C:\DOKUME~1\GESCHF~1\LOKALE~1\TEMP\3AB7CF.EXE

Ist das Trojanische Pferd TR/Swizzor.GF

Hallo,
Scanne dein System mal mit Escan (Anleitung genau lesen!) und poste das Ergebnis wie beschrieben.


Grüße Wildone

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({39fda070-61ba-11d2-ad84-00105a17b608})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({a1eedaa7-c4d8-11d2-ad9c-00105a17b608})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ca4fc24b-c65c-11d1-aa6f-000000000000})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ddd136ce-517b-11d2-ad03-00105a17b608})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({4f99a075-5227-11d2-ad06-00105a17b608})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({371d0743-7a57-11d2-ad5a-00105a17b608})! Action taken: No Action Taken.
Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({e9d55102-9683-11d2-ba68-0040053687fe})! Action taken: No Action Taken.
Mon Sep 26 15:47:04 2005 => System found infected with Conducent FlexPak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken.
Mon Sep 26 15:47:07 2005 => System found infected with Free Scratch and Win Spyware/Adware (updater.exe)! Action taken: No Action Taken.
Mon Sep 26 15:47:13 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.
Mon Sep 26 15:47:17 2005 => System found infected with WhenU.SaveNow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken.
Mon Sep 26 15:48:15 2005 => File C:\data infected by "Trojan-Downloader.Win32.IstBar.kc" Virus! Action Taken: No Action Taken.
Mon Sep 26 15:49:33 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\Window clock move.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus! Action Taken: No Action Taken.
Mon Sep 26 15:50:57 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\mpeg size amok\Else locks.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus! Action Taken: No Action Taken.
Mon Sep 26 15:54:50 2005 => File C:\Dokumente und Einstellungen\Geschäft\Desktop\Michi\Neuer Ordner\backups\backup-20050506-193613-993.dll infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:08:53 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0D85E745\adv620[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:08:58 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0D85E745\open[1].exe infected by "Trojan-Downloader.Win32.Small.ald" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:01 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\adv157[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:02 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\dia148[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:03 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\newexpl[2].php infected by "Exploit.VBS.Phel.i" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:08 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GDGBGN8N\dir4523455[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:14 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IPGJMD65\sploit[1].anr infected by "Trojan-Downloader.Win32.Ani.c" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:15 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\adv156[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:16 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\enter[1].htm infected by "Trojan-Downloader.JS.Psyme.ap" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:17 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\tool[1].txt infected by "Trojan-Downloader.Win32.Small.aqt" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:18 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\upAYB[1].int infected by "Trojan-Downloader.Win32.Swizzor.dj" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:23 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\prompt[1].php infected by "Trojan-Downloader.JS.IstBar.b" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:23 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:24 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\tool1[1].txt infected by "Trojan.Win32.LowZones.y" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:09:31 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QFYNEHAF\wow[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Mon Sep 26 16:14:08 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1126E93.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\11A9CD7.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\11E6ABC.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1217B7E.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1257C57.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\12C6FAA.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\13387E.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\13D88DC.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1459A05.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\14A498.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\157CA16.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\19EDB62.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1A1A9B3.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1B4403A.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1E9D1B2.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1FF2E08.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\230A194.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\27B8D97.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2838C52.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2A835F.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2D5574.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\31DF.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\32DBA9.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\350D36.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\36D532.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\383178.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\3873A0.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\3C04A5.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\410174.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\431DA5.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\496BED.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\50C4CD.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\50C9EC.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5A04D5.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5D5CBD.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5D61C4.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5FB335.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\617C7D.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\644E1A.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\65F616.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\668145.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\6D1555.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\7514A5.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\79A005.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\7C19ED.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\88EE40.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\8AEA46.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\8BAF75.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\94F04.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\9BD6BF.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\9BD9F7.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\A3AC2E.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\A97897.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\ADD8DA.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\BD1484.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\C7EE47.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\C88157.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\D38EB6.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\D49C2F.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\E2255F.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\EABA4F.EXE.VIR [**]
Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\F04976.EXE.VIR [**]
Mon Sep 26 16:58:48 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Mon Sep 26 15:48:30 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DALE PLUS RULE INSIDE\dateeach.exe tagged as "not-a-virus:AdWare.Lop.o". Action Taken: No Action Taken.
Mon Sep 26 15:49:33 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\ppotjgmp.exe tagged as "not-a-virus:AdWare.Lop.o". Action Taken: No Action Taken.
Mon Sep 26 16:07:07 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temp\updater_temp_Walkover Mapeditor\rollback\michi\mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Mon Sep 26 16:09:51 2005 => File C:\Program Files\mIRC\backup\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Mon Sep 26 16:09:53 2005 => File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Mon Sep 26 16:32:58 2005 => File C:\WINDOWS\NDNuninstall6_38.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken.
Mon Sep 26 16:54:30 2005 => File E:\michi\mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Mon Sep 26 15:45:13 2005 => Offending Folder found: C:\WINDOWS\System32\msview
Mon Sep 26 15:45:14 2005 => Offending Folder found: C:\PROGRA~1\myway
Mon Sep 26 15:47:04 2005 => Offending file found: C:\WINDOWS\gpinstall.exe
Mon Sep 26 15:47:07 2005 => Offending file found: C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\updater.exe
Mon Sep 26 15:47:13 2005 => Offending file found: C:\WINDOWS\iun6002.exe
Mon Sep 26 15:47:17 2005 => Offending file found: C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\cmdlineext02.dll
Mon Sep 26 16:58:48 2005 => Total Virus(es) Found: 42
Mon Sep 26 16:58:48 2005 => Total Errors: 681
Mon Sep 26 16:58:48 2005 => Time Elapsed: 01:16:10
Mon Sep 26 16:58:48 2005 => Total Objects Scanned: 103826
Mon Sep 26 15:41:55 2005 => Virus Database Date: 2005/09/09
Mon Sep 26 16:58:48 2005 => Virus Database Date: 2005/09/09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

Hallo,
also, lösche erstmal im IE unter Extras>>Internetoptionen deine temporären Internetdateien.
Dann lösche mal den Inhalt des Quarantäneordners von AntiVir.
Dann schau mal ob du unter Systemsteuerung>>Software solche Einträge findest:
Conducent FlexPak
Free Scratch and Win
zipitpro
WhenU.SaveNow
AyWay
wenn ja deinstallieren.
Dann besorgst du dir Killbox
und gibst du nacheinander folgende Dateien ein, und bestägst erst nach der letzten den Neustart:
C:\data
C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\Window clock move.exe
C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\mpeg size amok\Else locks.exe
C:\Dokumente und Einstellungen\Geschäft\Desktop\Michi\Neuer Ordner\backups\backup-20050506-193613-993.dll
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DALE PLUS RULE INSIDE\dateeach.exe
C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\ppotjgmp.exe
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\gpinstall.exe
C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\updater.exe
C:\WINDOWS\iun6002.exe
C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\cmdlineext02.dll
+ die Ordner
C:\WINDOWS\System32\msview
C:\PROGRA~1\myway

Dann scannst du mal folgendem Tool dein System.
Dann löschst du die im Ordner C:\Bases_X die MWAV.LOG, führst die kavupd.exe aus, und scannst danach wieder mit Escan im abgesicherten Modus, und postest das neue Log +den Inhalt der C:\smitfiles.txt



Grüße Wildone

Dann scannst du mal folgendem Tool dein System.

nachdem ich die datei runtergeladen und entpackt hab welche .exe muss ich den dann auswählen

und die programme die du genannt hast die unter software sein solllten sind nicht da.

Hallo,
das mit dem Tool habe ich etwas dürftig beschrieben, du mußt die Runthis.bat ausführen. Dann später die C:\smitfiles.txt posten.
Das unter Systemsteuerung>>Software keine derartigen Einträge sind, ist zwar schade aber dann muss man das halt manuell vornehmen, das sieht man dann beim nächsten Escan Logfile.


Grüße Wildone