moin @ all
habe vor zwei wochen nach intinsivem posting mein system neu aufgesetzt und alle sicherheitshinweise beachtet und system dementsprechend eingestellt! jetzt habe ich mal sicherheitshalber nen escan gemacht und schon wieder 8 viren entdeckt! kann sich das mal jemand ansehen und mir sagen, was hier los ist?
torsten

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Oct 21 23:52:08 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Fri Oct 21 23:52:15 2005 => System found infected with easysearch Spyware/Adware (index.html)! Action taken: No Action Taken.
Fri Oct 21 23:52:18 2005 => System found infected with hotbar Spyware/Adware (wbemess.lo_)! Action taken: No Action Taken.
Fri Oct 21 23:52:19 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken.
Sat Oct 22 01:16:29 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
Sat Oct 22 01:24:44 2005 => Scanning File C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\Infected.wav
Sat Oct 22 01:57:00 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Oct 21 23:51:59 2005 => Offending Key found: HKLM\Software\mm !!!
Fri Oct 21 23:52:03 2005 => Offending Key found: HKCU\Software\mm !!!
Fri Oct 21 23:52:08 2005 => Offending file found: C:\Dokumente und Einstellungen\tosta\Eigene Dateien\eigene bilder\porno\diana from 21 sextury hot pics whit pussy\diana from 21 sextury hot pics whit pussy\pics\index.html
Fri Oct 21 23:52:12 2005 => Offending Folder found: C:\Dokumente und Einstellungen\tosta\Eigene Dateien\eigene musik\midnight oil
Fri Oct 21 23:52:15 2005 => Offending file found: C:\Dokumente und Einstellungen\tosta\Eigene Dateien\Eigene Bilder\porno\diana from 21 sextury hot pics whit pussy\diana from 21 sextury hot pics whit pussy\pics\index.html
Fri Oct 21 23:52:16 2005 => Offending Folder found: C:\Dokumente und Einstellungen\tosta\Eigene Dateien\Eigene Musik\midnight oil
Fri Oct 21 23:52:18 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\spybot - search & destroy\backups\wbemess.lo_
Fri Oct 21 23:52:19 2005 => Offending file found: C:\WINDOWS\iun6002.exe
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Oct 22 01:57:00 2005 => Total Virus(es) Found: 8
Sat Oct 22 01:57:00 2005 => Total Errors: 225
Sat Oct 22 01:57:00 2005 => Time Elapsed: 02:05:04
Sat Oct 22 01:57:00 2005 => Total Objects Scanned: 58004
Fri Oct 21 23:50:00 2005 => Virus Database Date: 2005/10/22
Sat Oct 22 01:57:00 2005 => Virus Database Date: 2005/10/22
Sat Oct 22 08:23:50 2005 => Virus Database Date: 2005/10/22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~





Logfile of HijackThis v1.99.1

[edit]
bitte editiere deine links zukünftig, wie es dir u.a. hier angezeigt wird:

http://www.trojaner-board.de/showpost.php?p=171957&postcount=1


danke
GUA
[/edit]

hallo!

hier nochmal ein editiertes hjt-log! sorry!


Logfile of HijackThis v1.99.1
Scan saved at 13:37:42, on 23.10.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\Programme\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\FRITZ!DSL\IGDCTRL.EXE
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Apoint\Apoint.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\FRITZ!DSL\StCenter.exe
C:\Programme\FRITZ!DSL\FwebProt.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Programme\Apoint\Apntex.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programme\Raxco\PerfectDisk\PDSched.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Mozilla Thunderbird\thunderbird.exe
C:\Programme\BitComet\BitComet.exe
C:\Programme\Winamp\winamp.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://fritz.box/
R3 - URLSearchHook: (no name) - {01E69986-A054-4C52-ABE8-EF63DF1C5211} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: FRITZ!DSL Protect.lnk = C:\Programme\FRITZ!DSL\FwebProt.exe
O4 - Global Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O10 - Unknown file in Winsock LSP: c:\programme\fritz!dsl\sarah.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{341F3565-086A-46F0-B6B2-242E80BE211B}: NameServer = 192.168.122.252,192.168.122.253
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Programme\Raxco\PerfectDisk\PDSched.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe

[edit]
links entfernt
[/edit]