Hi!
Ich hab in letzter Zeit ein rießiges Problem.
Wenn ich an meinem Computer Arbeite, dann hat plötzlich irgend ein Programm 50% CPU-Auslastung(wechselnd, meißtens die Programme mit denen ich gerade Arbeite, manchmal aber auch ICQ, der nebenher läuft, oder so).
Das System reagiert dann praktisch überhaupt nicht mehr.
Nur noch der Taskmanager geht.
Wenn ich in diesem den betroffenen Prozess beende, dann folgt meißtens gleich ein weiterer Prozess mit der gleichen CPU-Auslastung.
Außerdem ist da eine gewisse Rundll32.exe, die ja normalerweiße von Windows.
Wenn ich diese aber beende, und danach das Programm mit den 50% CPU-Auslastung beende, dann funzt das System fast immer wieder.
Wenn ich den Prozess vorher nicht beende, dann geht es ewig so weiter(Ein Programm nach dem anderen, oder wenn ich ein neues Programm starte hat das dann eben 50% CPU-Auslastung)
Was mich außerdem wundert, ist, dass dieser Prozess rundll32.exe von mir und nicht vom System ausgeführt wird. Ich habe ihn allerdings bestimmt nicht ausgeführt. (Zumindest nicht bewusst)

Ich kann mir nur vorstellen, dass es ein Virus, oder sowas ist, denn ich hab schon alles mögliche ausprobiert, aber nichts hilft.

Habt ihr eine Idee?

Mein System:
Intel Pentium 4 CPU 3066 MHz
511 MB Ram
Windows XP Pro SP2
Firewall: Sygate Personal Firewall
Antivirus: AntiVir XP

Adaware und Spybot Search & Destroy haben nichts gefunden.

mfg peng

Servus, peng12341!

Poste doch einmal ein HJT Logfile nach Cidres Anleitung http://www.trojaner-board.de/showthread.php?t=17493
bis dann, stupormundi

Hier kommts:

Logfile of HijackThis v1.99.1
Scan saved at 10:55:28, on 03.10.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
C:\WINDOWS\system\wcdvtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Creative\NOMAD Jukebox Zen\PlayCenter2\CTNMRUN.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\programme\spiele\steam\steam.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\TGTSoft\StyleXP\StyleXP.exe
C:\Programme\Creative\MediaSource\Detector\CTDetect.exe
C:\Programme\T-COM\T-COM WLAN Manager T-Sinus 154data\Installer\WINXP\DTUSB11GMonitor.exe
C:\Programme\GetRight\GetRight.exe
C:\Programme\GetRight\GetRight.exe
C:\Programme\Winamp\winamp.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\MOZILL~1.6\MOZILLA.EXE
C:\PROGRA~1\ICQLite\ICQLite.exe
C:\DOKUME~1\****\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 7\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programme\TGTSoft\StyleXP\TGT_BHO.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Programme\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programme\FlashFXP\IEFlash.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 7\SnagItIEAddin.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [OWCWebCamDV] C:\WINDOWS\system\wcdvtray.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [NOMAD Detector] "C:\Programme\Creative\NOMAD Jukebox Zen\PlayCenter2\CTNMRUN.EXE"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\programme\spiele\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Creative Detector] C:\Programme\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRA~1\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: T-COM WLAN Manager T-Sinus 154data.lnk = C:\Programme\T-COM\T-COM WLAN Manager T-Sinus 154data\Installer\WINXP\DTUSB11GMonitor.exe
O8 - Extra context menu item: Alles mit Net Transport herunterladen - C:\Programme\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download with GetRight - C:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Herunterladen mit Net Transport - C:\Programme\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF2FE6BC-DECA-455A-83DA-913DD9BADDF7}: NameServer = 192.168.2.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: wampapache - Unknown owner - c:\wamp\apache\Apache.exe" --ntservice (file missing)
O23 - Service: wampmysqld - Unknown owner - c:\wamp\MySQL\bin\mysqld-nt.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Hi,
also ich sehe erst mal die rundll.exe nicht im Logfile (Wahrscheinlich hast du sie beendet). Aufgrund deiner Schilderung vermute ich aber das hier.
Bitte führe mal genau nach Anleitung einen eScan durch und poste die Ergebnisse.
Halte dich bitte genauestens an die von cidre beschriebene Anleitung!
cacatoa

OK. Hier das Logfile:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Oct 03 11:27:16 2005 => System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.
Mon Oct 03 11:27:16 2005 => System found infected with stylexp Spyware/Adware ({c333cf63-767f-4831-94ac-e683d962c63c})! Action taken: No Action Taken.
Mon Oct 03 11:27:16 2005 => System found infected with flashfxp Spyware/Adware ({e5a1691b-d188-4419-ad02-90002030b8ee})! Action taken: No Action Taken.
Mon Oct 03 11:27:16 2005 => System found infected with stylexp Spyware/Adware ({c333cf63-767f-4831-94ac-e683d962c63c})! Action taken: No Action Taken.
Mon Oct 03 11:27:16 2005 => System found infected with flashfxp Spyware/Adware ({e5a1691b-d188-4419-ad02-90002030b8ee})! Action taken: No Action Taken.
Mon Oct 03 11:27:16 2005 => System found infected with bearshare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.
Mon Oct 03 11:27:22 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.
Mon Oct 03 11:27:23 2005 => System found infected with bearshare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.
Mon Oct 03 11:27:24 2005 => System found infected with whistlesoftware Spyware/Adware (version.ini)! Action taken: No Action Taken.
Mon Oct 03 11:27:25 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:26 2005 => System found infected with midaddle Spyware/Adware (readme.url)! Action taken: No Action Taken.
Mon Oct 03 11:27:26 2005 => System found infected with midaddle Spyware/Adware (readme.url)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with rapidblaster Spyware/Adware (install.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:27 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:28 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:28 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:28 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:28 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:28 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:30 2005 => System found infected with rapidblaster Spyware/Adware (install.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:31 2005 => System found infected with rapidblaster Spyware/Adware (install.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:32 2005 => System found infected with win32.decisive.a Spyware/Adware (server.exe)! Action taken: No Action Taken.
Mon Oct 03 11:27:34 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Mon Oct 03 11:27:34 2005 => System found infected with coulomb dialer Spyware/Adware (loader.exe)! Action taken: No Action Taken.
Mon Oct 03 11:27:39 2005 => System found infected with broadcastpc Spyware/Adware (axinterop.shdocvw.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:39 2005 => System found infected with broadcastpc Spyware/Adware (interop.shdocvw.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:39 2005 => System found infected with broadcastpc Spyware/Adware (axinterop.shdocvw.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:39 2005 => System found infected with broadcastpc Spyware/Adware (interop.shdocvw.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with euniverse/keenvalue variant Spyware/Adware (bho.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with win32.decisive.a Spyware/Adware (server.exe)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with euniverse/keenvalue variant Spyware/Adware (bho.dll)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with win32.decisive.a Spyware/Adware (server.exe)! Action taken: No Action Taken.
Mon Oct 03 11:27:40 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Mon Oct 03 11:47:29 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Funstuff\smaster.zip infected by "not-virus:BadJoke.Win32.FakeFormat.m" Virus! Action Taken: No Action Taken.
Mon Oct 03 11:47:53 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Hackertools\enum-1.0.tar.gz infected by "HackTool.Win32.EnumPlus.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 11:48:13 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Hackertools\lustich\becher.exe infected by "Backdoor.Win32.SubSeven" Virus! Action Taken: No Action Taken.
Mon Oct 03 11:48:28 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Hackertools\Subseven\subseven20.zip infected by "Backdoor.Win32.SubSeven.20" Virus! Action Taken: No Action Taken.
Mon Oct 03 11:48:30 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Hackertools\wwwhack-1.946\wwwhack-1.946\wwwhack.exe infected by "HackTool.Win32.WwwHack.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 12:11:10 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Tools\Desktopstyling\Style XP\Wallpaper\78982.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken.
Mon Oct 03 14:16:10 2005 => File C:\Programme\DLH98\0204.dlm infected by "Trojan-Dropper.Win32.Agent.hz" Virus! Action Taken: No Action Taken.
Mon Oct 03 14:36:15 2005 => File C:\Programme\DLH98\Download\pc0402.zip infected by "Trojan-Dropper.Win32.Agent.hz" Virus! Action Taken: No Action Taken.
Mon Oct 03 17:02:13 2005 => File C:\Securitytools\enum.exe infected by "HackTool.Win32.EnumPlus.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 18:57:48 2005 => File C:\WINDOWS\system32\UMGR32.EXE e infected by "Backdoor.Win32.BO2K.s" Virus! Action Taken: No Action Taken.
Mon Oct 03 18:58:33 2005 => File C:\WINDOWS\Temp\ComputerSchock.zip infected by "not-virus:Hoax.Win32.ComputerSchock" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:18:42 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031306.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:35 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031381.exe infected by "HackTool.Win32.WwwHack.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:36 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031383.exe infected by "HackTool.Win32.WwwHack.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:38 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031385.exe infected by "Backdoor.Win32.SubSeven.20" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:40 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031386.exe infected by "Backdoor.Win32.SubSeven" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:41 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031387.exe infected by "Backdoor.Win32.SubSeven" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:45 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031388.exe infected by "Backdoor.Win32.SubSeven.20" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:46 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031392.exe infected by "Backdoor.Win32.Netbus.21.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:46 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031393.exe infected by "Backdoor.Win32.NBSpy" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:47 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031394.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:48 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031395.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:49 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031397.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:50 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031398.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:50 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031400.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:52 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031401.exe infected by "Backdoor.Win32.MoonPie.13" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:35:53 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031402.exe infected by "Backdoor.Win32.SubSeven" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:36:02 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031410.exe infected by "HackTool.Win32.John" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:36:03 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031419.EXE infected by "Backdoor.Win32.BO.a2" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:36:03 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031420.EXE infected by "Backdoor.Win32.BO.a2" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:36:03 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031421.EXE infected by "Backdoor.Win32.BO.a2" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:36:03 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031422.EXE infected by "Backdoor.Win32.BO.a" Virus! Action Taken: No Action Taken.
Mon Oct 03 21:59:28 2005 => Total Disinfected Files: 0

Teil 2:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Oct 03 11:27:05 2005 => File C:\WINDOWS\system32\r_server.exe tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.22. No Action Taken.
Mon Oct 03 11:35:33 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Cracktools\rainbowcrack-1.2-win.zip tagged as not-a-virus:PSWTool.Win32.Rainbow.12.a. No Action Taken.
Mon Oct 03 11:47:37 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Hackertools\a_msn_monitor.exe tagged as not-a-virus:Monitor.Win32.MsnChatMonitor.33. No Action Taken.
Mon Oct 03 11:57:41 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\slimftpd\SlimFTPd.exe tagged as not-a-virus:Server-FTP.Win32.SlimFTPd.316. No Action Taken.
Mon Oct 03 11:57:41 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\slimftpd.zip tagged as not-a-virus:Server-FTP.Win32.SlimFTPd.316. No Action Taken.
Mon Oct 03 11:57:58 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\susetup.exe tagged as not-a-virus:Server-FTP.Win32.Serv-U.6000. No Action Taken.
Mon Oct 03 12:10:57 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Tools\Desktopstyling\Style XP\61178.exe tagged as "not-a-virus:AdWare.Win32.Quick.a". Action Taken: No Action Taken.
Mon Oct 03 12:13:21 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Tools\Internettools\Filesharetools\BSINSTALL.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
Mon Oct 03 12:44:34 2005 => File C:\Dokumente und Einstellungen\*****\Eigene Dateien\Downloads\Tools\Voicekommunikation\mirc614.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.614. No Action Taken.
Mon Oct 03 13:39:56 2005 => File C:\My Downloads\MiRC.v6.16.WinALL.Incl.Keygen-NGEN.rar tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Mon Oct 03 13:41:26 2005 => File C:\My Downloads\Remote Administrator (Radmin) 2.2 + serial + manual + tools.rar tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.20. No Action Taken.
Mon Oct 03 16:08:46 2005 => File C:\Programme\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Mon Oct 03 16:12:35 2005 => File C:\Programme\Radmin\raddrv.dll tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.20. No Action Taken.
Mon Oct 03 16:12:35 2005 => File C:\Programme\Radmin\radmin.exe tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.22. No Action Taken.
Mon Oct 03 16:12:36 2005 => File C:\Programme\Radmin\r_server.exe tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.22. No Action Taken.
Mon Oct 03 17:06:57 2005 => File C:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP156\A0031840.exe tagged as not-a-virus:Monitor.Win32.MsnChatMonitor.33. No Action Taken.
Mon Oct 03 18:07:56 2005 => File C:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP216\A0051700.exe tagged as "not-a-virus:Dialer.Win32.gen". Action Taken: No Action Taken.
Mon Oct 03 18:57:07 2005 => File C:\WINDOWS\system32\raddrv.dll tagged as not-a-virus:RemoteAdmin.Win32.RAdmin.20. No Action Taken.
Mon Oct 03 19:15:29 2005 => File D:\Sicherung\Eigene Dateien\Funstuff\Animationen und Games\Games\sex2000.exe tagged as "not-a-virus:Porn-Dialer.Win32.Generic". Action Taken: No Action Taken.
Mon Oct 03 19:54:07 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031095.exe tagged as not-a-virus:Server-FTP.Win32.Serv-U.6000. No Action Taken.
Mon Oct 03 20:46:26 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031176.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.614. No Action Taken.
Mon Oct 03 21:17:45 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031294.exe tagged as "not-a-virus:AdWare.Win32.SaveNow.z". Action Taken: No Action Taken.
Mon Oct 03 21:18:41 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031305.exe tagged as "not-a-virus:AdWare.Win32.Quick.a". Action Taken: No Action Taken.
Mon Oct 03 21:34:46 2005 => File D:\System Volume Information\_restore{BB004485-BFF1-4856-BBA8-D475C2DDE5ED}\RP151\A0031363.exe tagged as not-a-virus:Server-FTP.Win32.SlimFTPd.316. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Oct 03 11:27:18 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\bearshare !!!
Mon Oct 03 11:27:18 2005 => Offending Key found: HKLM\Software\magnet\handlers\bearshare !!!
Mon Oct 03 11:27:18 2005 => Offending Key found: HKLM\Software\bearshare !!!
Mon Oct 03 11:27:18 2005 => Offending Key found: HKLM\Software\freshdevices !!!
Mon Oct 03 11:27:18 2005 => Offending value found in HKLM\Software\Licenses: {i56b3cf0d9ab991e1} !!!
Mon Oct 03 11:27:18 2005 => Offending value found in HKLM\Software\Licenses: {056b3cf0d9ab991e1} !!!
Mon Oct 03 11:27:22 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\internet\filesharing\bearshare.lnk
Mon Oct 03 11:27:23 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Startmenü\programme\internet\filesharing\bearshare.lnk
Mon Oct 03 11:27:24 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\emulation\mame32\folders\version.ini
Mon Oct 03 11:27:25 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\flash\flash_chec3f8c1a3ee6939\index.html
Mon Oct 03 11:27:26 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\hackertools\back orifice 2000\pelck204\readme.url
Mon Oct 03 11:27:26 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\hackertools\optix\optixpro133\builder\pelck204\readme.url
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\documentation\installation guide\data\install.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\tools_and_scripts\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\tools_and_scripts\ssi_templates\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\cache\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\ips_kernel\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\lang\en\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\modules\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\retail\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\skin_acp\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\skin_acp\ipb2_standard\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\skin_cache\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\sources\admin\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\sources\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\sources\lib\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\sources\misc\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\sources\sql\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_avatars\index.html
Mon Oct 03 11:27:27 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_emoticons\default\index.html
Mon Oct 03 11:27:28 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_images\1\folder_mime_types\index.html
Mon Oct 03 11:27:28 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_images\1\folder_team_icons\index.html
Mon Oct 03 11:27:28 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_images\1\index.html
Mon Oct 03 11:27:28 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\style_images\index.html
Mon Oct 03 11:27:28 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\php\invision powerboard\2p0p0pf3\upload\uploads\index.html
Mon Oct 03 11:27:30 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\phpbb\phpbb2-2.0.17-deutsch\phpbb2\docs\install.html
Mon Oct 03 11:27:31 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\phpbb-2.0.14\phpbb2\docs\install.html
Mon Oct 03 11:27:32 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\tools\internettools\icq\icq server\icqservr\server.exe
Mon Oct 03 11:27:34 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\tools\programmieren\googleapi\googleapi\javadoc\index.html
Mon Oct 03 11:27:34 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\tools\videobearbeitung\hypercamv1.72.00loaderlash\loader.exe
Mon Oct 03 11:27:35 2005 => Offending Folder found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\tools\webserver\phpmyadmin-2.6.4-rc1\phpmyadmin\libraries\dbi
Mon Oct 03 11:27:35 2005 => Offending Folder found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\downloads\tools\webserver\phpmyadmin-2.6.4-rc1\phpmyadmin-2.6.4-rc1\libraries\dbi
Mon Oct 03 11:27:39 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\visual studio projects\windowsapplication1\bin\axinterop.shdocvw.dll
Mon Oct 03 11:27:39 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\visual studio projects\windowsapplication1\bin\interop.shdocvw.dll
Mon Oct 03 11:27:39 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\visual studio projects\windowsapplication1\obj\axinterop.shdocvw.dll
Mon Oct 03 11:27:39 2005 => Offending file found: C:\Dokumente und Einstellungen\*****\Eigene Dateien\visual studio projects\windowsapplication1\obj\interop.shdocvw.dll
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Oct 03 21:59:28 2005 => Total Virus(es) Found: 120
Mon Oct 03 21:59:28 2005 => Total Errors: 702
Mon Oct 03 21:59:28 2005 => Time Elapsed: 10:32:20
Mon Oct 03 21:59:28 2005 => Total Objects Scanned: 211517
Mon Oct 03 11:25:53 2005 => Virus Database Date: 2005/10/03
Mon Oct 03 21:59:28 2005 => Virus Database Date: 2005/10/03
Mon Oct 03 22:17:41 2005 => Virus Database Date: 2005/10/03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

P.S.: Ist 10,5 Stunden Scanzeit eigentlich normal? (ca. 107 GB Daten)

Du hattest mal versucht, mehrere Backdoor-Trojaner zu beseitigen. Das dürfte Dir wohl nicht ganz gelungen sein. Was diese Teile wirklich angerichtet haben, ist jetzt nicht mehr nachzuvollziehen. Es befinden sich infizierte Dateien in der Systemwiederherstellung. Das könnte man beenden, indem du die Systemwiederherstellung ausschaltest, Rechner aus, Rechner an, Systemwiederherstellung wieder anschaltest. Damit ist aber nicht wirklich was passiert.
Meine Empfehlung lautet daher:
System neu aufsetzen!
Da du dich ja offensichtlich auf demenstprechenden Seiten bewegst und mit hackertools etc. arbeitest, solltest Du eigentlich wissen, was zu tun ist.
cacatoa

Servus, peng12341!

P.S.: Ist 10,5 Stunden Scanzeit eigentlich normal? (ca. 107 GB Daten)

Nein, das ist schon heftig, aber bei den Funden....
Dein System ist dermaßen verseucht, dass an eine Reinigung sinnvollerweise nicht mehr gedacht werden kann! (U.a.

...infected by "HackTool.Win32.EnumPlus.a" Virus!
... infected by "Backdoor.Win32.SubSeven" Virus!

)
Daher hilft nur mehr neu Aufsetzen nach Cidres Anleitung http://www.trojaner-board.de/showthread.php?t=12154
Lies´ Dir alles genau durch, vor allem den Info Teil zum Thema Backdoors.
Alles Gute, stupormundi
~~Edit~~ Servus, cacatoa! Warst schneller~~/Edit~~

Gut, dann mal danke für die Tips. Werd mal gucken, was ich jetzt mach.
Muss erstmal maine gesamten Daten irgendwo auslagern...