| |
| |||||||
Log-Analyse und Auswertung: ein programm namens " unspypc "Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
05.04.2006, 16:33
| #1 |
| |  ein programm namens " unspypc " ein programm namens " unspypc " mein problem ist wie folgt! nach dem start öffnet sich ein programm namens unspypc automatisch Ein Pop Up Fenster das aussieht wie ein Virenscanner , es läuft ca. 20 Sekunden lässt sich dann erst schliessen. Ich kapier es nicht .... Antivir tgl. aktualisiert Antivir dann mannuell den Rechner scanner lassen ca. 2 Stunden Sygate Firewall Dann habe mir das Hijack This geladen und gescannt ! Das war mein Protokoll aus Hijack This Logfile of HijackThis v1.95.0 Scan saved at 11:18:43, on 05.04.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\ATI-CPanel\atiptaxx.exe C:\Programme\Ahead\InCD\InCD.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe C:\PROGRA~1\T-Com\T-DSLS~1\SMARTB~1\Smartbridge.exe C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe C:\Programme\T-Online\DSL-Manager\TODslMgr.exe C:\Programme\QuickTime\qttask.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBSVC.exe C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\svchost.exe C:\Programme\T-Com\T-DSL Support Center\bin\mpbtn.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\Programme\T-Online\DSL-Manager\TODslSvc.exe C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE C:\PROGRAMME\T-ONLINE\T-ONLINE_SOFTWARE_5\BROWSER\BROWSER.EXE C:\Programme\T-Online\T-Online_Software_5\eMail\MAIL.EXE c:\programme\t-online\t-online_software_5\browser\dlman.exe C:\Programme\WinRAR\WinRAR.exe C:\DOKUME~1\RAINER~1\LOKALE~1\Temp\Rar$EX02.031\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.t-online.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://195.225.176.14/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://195.225.176.14/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://195.225.176.14/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://195.225.176.14/ie R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://195.225.176.14/ie R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=http://195.225.176.14/ R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll R3 - URLSearchHook: (no name) - {63357233-09ED-F867-C6CB-19DBF500431B} - SpyElim.dll (file missing) O1 - Hosts: localhost 127.0.0.1 O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file) O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\T-Com\T-DSLS~1\SMARTB~1\Smartbridge.exe O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart O4 - HKLM\..\Run: [T-Online DSL-Manager] "C:\Programme\T-Online\DSL-Manager\TODslMgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [WinInitDll] KeywordFinder.exe O4 - HKLM\..\Run: [exe.fcwmd] C:\WINDOWS\system32\dmwcf.exe O4 - HKLM\..\Run: [exe.wsimd] C:\WINDOWS\system32\dmisw.exe O4 - HKLM\..\Run: [exe.zckmd] C:\WINDOWS\system32\dmkcz.exe O4 - HKLM\..\Run: [exe.igymd] C:\WINDOWS\system32\dmygi.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [monitor] Explorer.exe monitor.exe O4 - HKCU\..\Run: [UnSpyPC] "C:\Programme\UnSpyPC\UnSpyPC.exe" O4 - HKCU\..\Run: [media64] systemdll.exe O4 - HKCU\..\Run: [xxtoolbar] pizda.exe O4 - HKCU\..\Run: [sysconf16] NsCplTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: T-DSL Support Center.lnk = C:\Programme\T-Com\T-DSL Support Center\bin\matcli.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: ICQ Lite (HKLM) O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O9 - Extra button: Scan and protect your PC (HKCU) O9 - Extra 'Tools' menuitem: Scan and protect your PC (HKCU) O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - hp://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - hp://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://www.pussyharem.com/stream/mmp.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.co...133.3007638889 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hs://download.macromedia.com/pub/...sh/swflash.cab Danach habe ich unter Systemsteuerung , Software das Icon und das Programm deinstalliert. Dennoch zeigt High Jack this noch an : Logfile of HijackThis v1.95.0 Scan saved at 12:50:01, on 05.04.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Sygate\SPF\smc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\ATI-CPanel\atiptaxx.exe C:\Programme\Ahead\InCD\InCD.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe C:\PROGRA~1\T-Com\T-DSLS~1\SMARTB~1\Smartbridge.exe C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe C:\Programme\T-Online\DSL-Manager\TODslMgr.exe C:\Programme\QuickTime\qttask.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\T-Com\T-DSL Support Center\bin\mpbtn.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\eEBSVC.exe C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\System32\alg.exe C:\Programme\T-Online\DSL-Manager\TODslSvc.exe C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE C:\PROGRAMME\T-ONLINE\T-ONLINE_SOFTWARE_5\BROWSER\BROWSER.EXE C:\PROGRAMME\T-ONLINE\T-ONLINE_SOFTWARE_5\EMAIL\MAIL.EXE C:\Programme\WinRAR\WinRAR.exe C:\DOKUME~1\RAINER~1\LOKALE~1\Temp\Rar$EX00.719\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://google.icq.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.t-online.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://195.225.176.14/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://195.225.176.14/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://195.225.176.14/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://195.225.176.14/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=http://195.225.176.14/ie R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://195.225.176.14/ie R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=http://195.225.176.14/ R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll R3 - URLSearchHook: (no name) - {63357233-09ED-F867-C6CB-19DBF500431B} - SpyElim.dll (file missing) O1 - Hosts: localhost 127.0.0.1 O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll O3 - Toolbar: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - (no file) O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\T-Com\T-DSLS~1\SMARTB~1\Smartbridge.exe O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart O4 - HKLM\..\Run: [T-Online DSL-Manager] "C:\Programme\T-Online\DSL-Manager\TODslMgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [WinInitDll] KeywordFinder.exe O4 - HKLM\..\Run: [exe.fcwmd] C:\WINDOWS\system32\dmwcf.exe O4 - HKLM\..\Run: [exe.wsimd] C:\WINDOWS\system32\dmisw.exe O4 - HKLM\..\Run: [exe.zckmd] C:\WINDOWS\system32\dmkcz.exe O4 - HKLM\..\Run: [exe.igymd] C:\WINDOWS\system32\dmygi.exe O4 - HKLM\..\Run: [exe.fbgmd] C:\WINDOWS\system32\dmgbf.exe O4 - HKLM\..\Run: [exe.ynjmd] C:\WINDOWS\system32\dmjny.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [monitor] Explorer.exe monitor.exe O4 - HKCU\..\Run: [UnSpyPC] "C:\Programme\UnSpyPC\UnSpyPC.exe" O4 - HKCU\..\Run: [media64] systemdll.exe O4 - HKCU\..\Run: [xxtoolbar] pizda.exe O4 - HKCU\..\Run: [sysconf16] NsCplTray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: T-DSL Support Center.lnk = C:\Programme\T-Com\T-DSL Support Center\bin\matcli.exe O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: ICQ Lite (HKLM) O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - hp://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - hp://download.microsoft.com/downlo...22/wmv9VCM.CAB O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://www.pussyharem.com/stream/mmp.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.co...133.3007638889 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h://download.macromedia.com/pub/...sh/swflash.cab Alles clean ? Hoffe das hier versteckt nicht was ? O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\spacklsp.dll __________________ Ich habe NULL Ahnung .... also manuell werde ich da nix hinkriegen bräuchte eine Software die da aufräumt .. Spybot hat versagt ..... Ad aware auch |
|
05.04.2006, 17:44
| #2 | |
  | ein programm namens " unspypc " @Kasheba
__________________Zitat:
|
|
05.04.2006, 19:05
| #3 |
| | ein programm namens " unspypc " Ähm ..... die habe ich doch drauf
__________________ Du meinst neu aufspielen ? |
|
| Themen zu ein programm namens " unspypc " |
| ad aware, adobe, avg, bho, browser, email, explorer, hijack, hijack this, hijackthis, icqtoolbar, internet, internet explorer, microsoft, monitor, object, pop up fenster, problem, programm, programme, scan, sekunden, shockwave, software, system, t-online, temp, unknown file in winsock lsp, urlsearchhook, windows, windows xp, öffnet |
Linear-Darstellung
