Hallo,

nachdem ich meinen eigenen Rechner gestern mit eurer Hilfe wieder Virenfrei bekommen habe, hier das nächste Problem:

Dieser PC scheint sehr verseucht zu sein. AntiVir hat einiges gefunden und gelöscht.
Gefunden wurde auch der Virus Alcra B der anscheinend nicht so leicht zu beseitigen ist. Er versteckt sich in Zip Datein, die AntiVir nicht löschen kann.
Der angegebene Ordner ist auch nicht zu finden.
Hier mal die Hijack log file:
Logfile of HijackThis v1.99.1
Scan saved at 19:59:39, on 24.02.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE
C:\Programme\Xfire\Xfire.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Zeux\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [S3Ehc8] C:\WINDOWS\ivrhjka.exe
O4 - HKLM\..\Run: [S3Eh$vùõš/‚²‘ÆßfÏNC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\ivrhjka.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: D-Link AirPlus G+ Wireless Adapter Utility.lnk = C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe

Wie werde ich den Wurm jetzt los??

@RudeGirl
scanne dein system bitte mit escan


chaosman

Hier die Logfile von escan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Feb 24 20:32:38 2006 => System found infected with yoursitebar Spyware/Adware ({86227d9c-0efe-4f8a-aa55-30386a3f5686})! Action taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => System found infected with yoursitebar Spyware/Adware ({86227d9c-0efe-4f8a-aa55-30386a3f5686})! Action taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => System found infected with dyfuca Spyware/Adware ({00000010-6f7d-442c-93e3-4a4827c2e4c8})! Action taken: No Action Taken.
Fri Feb 24 20:32:39 2006 => System found infected with casinoonnet Spyware/Adware (bszip.dll)! Action taken: No Action Taken.
Fri Feb 24 20:32:39 2006 => System found infected with free scratch and win Spyware/Adware (updater.exe)! Action taken: No Action Taken.
Fri Feb 24 20:32:43 2006 => System found infected with ezula Spyware/Adware (internet.lnk)! Action taken: No Action Taken.
Fri Feb 24 20:32:47 2006 => System found infected with free scratch and win Spyware/Adware (updater.exe)! Action taken: No Action Taken.
Fri Feb 24 20:32:47 2006 => System found infected with cydoor Spyware/Adware (common.dll)! Action taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "ameopt Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "ameopt Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "kapabout Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "yoursitebar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:38 2006 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:39 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:39 2006 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:46 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Fri Feb 24 20:32:46 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Fri Feb 24 20:41:45 2006 => File C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EDGVMX25\send_car_int[1].htm infected by "Exploit.HTML.CodeBaseExec" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Fri Feb 24 20:32:39 2006 => Offending file found: C:\WINDOWS\system32\bszip.dll
Fri Feb 24 20:32:39 2006 => Offending file found: C:\DOKUME~1\Benny\LOKALE~1\Temp\updater.exe
Fri Feb 24 20:32:43 2006 => Offending file found: C:\Dokumente und Einstellungen\Benny\Desktop\internet.lnk
Fri Feb 24 20:32:47 2006 => Offending file found: C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\temp\updater.exe
Fri Feb 24 20:32:47 2006 => Offending file found: C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\temp\{6bbb3874-414b-4248-8b07-4c7e3e04be78}\{cd4c8bab-29e8-4f95-b685-b9f53ab89f15}\common.dll
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Fri Feb 24 20:32:39 2006 => Offending Folder found: C:\limewire
Fri Feb 24 20:32:39 2006 => Offending Folder found: C:\Programme\istsvc
Fri Feb 24 20:32:46 2006 => Offending Folder found: C:\Dokumente und Einstellungen\Benny\Startmenü\programme\limewire
Fri Feb 24 20:32:46 2006 => Offending Folder found: C:\Dokumente und Einstellungen\Benny\Startmenü\Programme\limewire
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\ameopt !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\ameopt !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\kapabout !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\limewire !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\magnet\handlers\limewire !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\avenue media !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\istsvc !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\limewire !!!
Fri Feb 24 20:32:38 2006 => Offending Key found: HKLM\Software\yoursitebar !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fri Feb 24 20:59:34 2006 => Total Errors: 11
Fri Feb 24 20:59:34 2006 => Time Elapsed: 00:27:22
Fri Feb 24 20:59:34 2006 => Total Objects Scanned: 81224
Fri Feb 24 20:31:30 2006 => Virus Database Date: 2/16/2006
Fri Feb 24 20:59:34 2006 => Virus Database Date: 2/16/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

@RudeGirl
lade adaware und spybot
beide programme updaten

lösche in den abgesicherten modus manuell:

C:\WINDOWS\system32\bszip.dll
C:\DOKUME~1\Benny\LOKALE~1\Temp\updater.exe
C:\Dokumente und Einstellungen\Benny\Desktop\internet.lnk
C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\temp\updater.exe
C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\temp\{6bbb3874-414b-4248-8b07-4c7e3e04be78}\{cd4c8bab-29e8-4f95-b685-b9f53ab89f15}\common.dll
C:\Programme\ISTsvc\istsvc.exe
C:\limewire
C:\Dokumente und Einstellungen\Benny\Startmenü\programme\limewire
C:\WINDOWS\ivrhjka.exe


fixe mit HJT
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O4 - HKLM\..\Run: [IST Service] C:\Programme\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [S3Ehc8] C:\WINDOWS\ivrhjka.exe
O4 - HKLM\..\Run: [S3Eh$vùõš/‚²‘ÆßfÏNC:\Programme\ISTsvc\istsvc.exe] C:\WINDOWS\ivrhjka.exe

neu booten, neues HJT logfile posten

chaosman

Habe alles so wie oben beschrieben gemacht!
hier die neue Logfile:

Logfile of HijackThis v1.99.1
Scan saved at 21:56:11, on 24.02.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Programme\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Zeux\Hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Xfire.lnk = C:\Programme\Xfire\Xfire.exe
O4 - Global Startup: D-Link AirPlus G+ Wireless Adapter Utility.lnk = C:\Programme\D-Link\D-Link AirPlus G+ Wireless Adapter Utility\DWLGTI.EXE
O8 - Extra context menu item: &Google-Suche - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://c:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe