about blank seit heute - Trojaner Bitte um Hilfe

sapan · 10.01.2005, 19:20

2. Teil:

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\digital imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\digital imaging\bin\hpqthb08.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Suchen mit Copernic Agent - C:\Programme\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Starten von Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O15 - Trusted Zone: http://*.63.219.181.7
O16 - DPF: ChatSpace Full Java Client 4.0.0.301 - http://63.102.226.240:8000/Java/cfs40301.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/275d6d4e...dxIE601_de.cab
O16 - DPF: {65343C5D-E08B-4008-B67B-9D5653C6BE52} (IELoaderCtl Class) - http://shortpay.global-netcom.de/ieloader.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp02.photoprintit.de/microsi...eUploader3.cab
O16 - DPF: {E0B795B4-FD95-4ABD-A375-27962EFCE8CF} (StarInstall Control) - http://install.stardialer.de/StarInstall.ocx
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{12EC4F2D-6ED9-454F-B76D-AC06EBADAD8A}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{4511D7F3-242B-4355-818A-8621930F3B5D}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8FB5945-1FC0-454A-BF01-C0E83D9C9536}: NameServer = 69.50.166.94 69.31.80.244
O17 - HKLM\System\CS1\Services\Tcpip\..\{12EC4F2D-6ED9-454F-B76D-AC06EBADAD8A}: NameServer = 193.170.244.19,193.170.244.20
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll
O18 - Filter: text/html - {CF692218-F3C7-49C1-B8EF-3ED6F286CB76} - C:\WINDOWS\system32\hhii.dll
O18 - Filter: text/plain - {CF692218-F3C7-49C1-B8EF-3ED6F286CB76} - C:\WINDOWS\system32\hhii.dll
O23 - Service: Adobe Active File Monitor - Unknown - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programme\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect - Unknown - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

BITTE HELFT MIR!!!!!
Ich habe den Computer erst zu Weihnachten neu aufgesetzt

sapan · 11.01.2005, 22:14

Bitte überprüft jetzt meinen Logfile:

Logfile of HijackThis v1.99.0
Scan saved at 22:07:34, on 11.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Teil 1:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Executive Software\DiskeeperLite\DKService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Programme\Jet2Web Informer\informer.exe
C:\Programme\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon06.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programme\Spamihilator\spamihilator.exe
C:\Programme\Steganos Internet Trace Destructor 7\ITD7.exe
C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Programme\TraXEx\TraXEx.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programme\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Andi\Desktop\HijackThis.exe

sapan · 11.01.2005, 22:15

Hier Teil 2:

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://fastsearchweb.com/srh.php?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\Andi\LOKALE~1\Temp\sp.dll/sp.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orf.at/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\Andi\LOKALE~1\Temp\sp.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\panels\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\Programme\WinSweep\ws.js
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.aon.at:8080;http=proxy.aon.at:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.jet2web.net;*.aon.at;<local>
R3 - Default URLSearchHook is missing
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Programme\DAP\DAPBHO.dll
O2 - BHO: DAPBHO Class - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:\Programme\DAP\DAPIEBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar1_27.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: (no name) - {B6F54C3F-085F-49A6-A9F0-3C8FB2B5E4CF} - C:\WINDOWS\system32\hhii.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Programme\DAP\DAPIEBar.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Programme\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\system32\iecust.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [jservice] C:\Programme\Jet2Web Informer\informer.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Programme\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [HPHUPD06] C:\Programme\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"
O4 - HKCU\..\Run: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"
O4 - HKCU\..\Run: [Spamihilator] "C:\Programme\Spamihilator\spamihilator.exe"
O4 - HKCU\..\Run: [ITD7] "C:\Programme\Steganos Internet Trace Destructor 7\ITD7.exe" -boot
O4 - HKCU\..\Run: [IncrediMail] C:\Programme\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe"
O4 - Startup: desktop(2)(2).ini
O4 - Startup: desktop(2).ini
O4 - Startup: desktop(3)(2).ini
O4 - Startup: desktop(3).ini
O4 - Startup: desktop(4).ini
O4 - Startup: TraXEx.lnk = C:\Programme\TraXEx\TraXEx.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: desktop(2)(2).ini
O4 - Global Startup: desktop(2).ini
O4 - Global Startup: desktop(3)(2).ini
O4 - Global Startup: desktop(3).ini
O4 - Global Startup: desktop(4).ini
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\digital imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Schnellstart.lnk = C:\Programme\HP\digital imaging\bin\hpqthb08.exe
O4 - Global Startup: Kaspersky Anti-Hacker.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Suchen mit Copernic Agent - C:\Programme\Copernic Agent\Web\SearchExt.htm
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar2.dll/cmsimilar.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Starten von Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~2\COPERN~1.EXE
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: ChatSpace Full Java Client 4.0.0.301 - http://63.102.226.240:8000/Java/cfs40301.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/275d6d4e...dxIE601_de.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp02.photoprintit.de/microsi...eUploader3.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex...l_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{12EC4F2D-6ED9-454F-B76D-AC06EBADAD8A}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{4511D7F3-242B-4355-818A-8621930F3B5D}: NameServer = 69.50.166.94,69.31.80.244
O17 - HKLM\System\CCS\Services\Tcpip\..\{B8FB5945-1FC0-454A-BF01-C0E83D9C9536}: NameServer = 69.50.166.94 69.31.80.244
O17 - HKLM\System\CS1\Services\Tcpip\..\{12EC4F2D-6ED9-454F-B76D-AC06EBADAD8A}: NameServer = 193.170.244.19,193.170.244.20
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Programme\HP\hpcoretech\comp\hpuiprot.dll
O18 - Filter: text/plain - {CF692218-F3C7-49C1-B8EF-3ED6F286CB76} - C:\WINDOWS\system32\hhii.dll
O23 - Service: Adobe Active File Monitor - Unknown - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Programme\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Photoshop Elements Device Connect - Unknown - C:\Programme\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

und jetzt noch nach dem e-Scan siehe nächste Antworten!

sapan · 11.01.2005, 22:19

Und hier nach dem e-Scan:

Teil 1:

File C:\Programme\QuickSearch\QuickSearchBar1_27.dll infected by "not-a-virus:AdWare.ToolBar.Quick.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\ezPopStub.exe infected by "not-a-virus:AdWare.EZula.u" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\nlsfuncs.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\openconf.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\WebRebates_Auto_InstallSilent.exe infected by "not-a-virus:AdWare.WebRebates.b" Virus. Action Taken: No Action Taken.
File C:\Programme\filesubmit\apresentfortigger.zip\NNEZTA388.exe infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\Programme\filesubmit\apresentfortigger.zip\TBEZA127Q.exe infected by "not-a-virus:AdWare.ToolBar.Quick.a" Virus. Action Taken: No Action Taken.
File C:\Programme\Web Offer\CHPON.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\Programme\Web_Rebates\disp1150.exe infected by "not-a-virus:AdWare.WebRebates.c" Virus. Action Taken: No Action Taken.
File C:\Programme\Web_Rebates\WebRebates1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507116.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507151.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507203.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.

sapan · 11.01.2005, 22:20

Teil 2:

File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507234.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507243.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507281.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507420.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP152\A0507979.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508139.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508145.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508327.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508430.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508471.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508491.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508499.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508583.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0508962.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP153\A0509203.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509322.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509328.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509330.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509336.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509382.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509567.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509729.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509734.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509757.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP154\A0509907.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP155\A0510034.exe tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP157\A0510106.exe infected by "not-a-virus:AdWare.EZula.z" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP157\A0510107.dll infected by "not-a-virus:AdWare.EZula.ae" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP157\A0511154.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP157\A0511396.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP157\A0511715.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP163\A0520637.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526424.exe infected by "Trojan-Dropper.Win32.Small.pt" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526425.dll infected by "Trojan.Win32.StartPage.sl" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526426.exe infected by "Trojan-Dropper.Win32.Small.ow" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526427.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526428.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526429.exe infected by "not-a-virus:AdWare.FindSpy.a" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526430.exe infected by "Trojan-Dropper.Win32.Small.pt" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526471.dll infected by "not-a-virus:AdWare.EZula.x" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526472.dll infected by "not-a-virus:AdWare.EZula.ab" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526473.exe infected by "not-a-virus:AdWare.EZula.u" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526589.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526590.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526591.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526592.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526593.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526594.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526595.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526598.dll infected by "not-a-virus:AdWare.ToolBar.ISearch.b" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{8C7E7928-537E-4DC2-B251-F360F73170E9}\RP179\A0526600.dll infected by "not-a-virus:AdWare.NewDotNet" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\system32\drivers\etc\winupd\hidden32.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken.

Ich habe alles mit Adware Professional gescannt und alles was da war gelöscht. Muss ich jetzt noch etwas machen. Bitte gebt mir bald Antwort.

Gruß und Dank
SAPAN

chaosman · 11.01.2005, 22:55

@sapan
systemwiederherstellung deaktivieren, neu booten, systemwiederherstellung aktivieren.
newdot.net über systemsteuerung, software deinstallieren,
danach sofort mit spybot scannen, wenn deine Internet verbindung nicht geht, diese mit LSP-Fix reparieren.
danach wechsle in den abgesicherten modus und löasche die andere dateien manuell.
neu booten und ein neues HJT logfile posten
chaosman

sapan · 12.01.2005, 07:29

Hilfe gibt es jemanden der mir sagen kann was ich
jetzt noch machen muss. Es funktioniert zwar alles
wieder aber EScan hat noch etwas gefunden.
Bin ich jetzt wieder Trojanerfrei oder muss ich
noch etwas löschen bzw. scannen.
Kann mir auch wer sagen welche Dateien ich manuell löschen
muss damit ich nicht die falschen Dateien versehentlich lösche.

Bitte um Antwort.

SAPAN

about blank seit heute - Trojaner Bitte um Hilfe

Plagegeister aller Art und deren Bekämpfung: about blank seit heute - Trojaner Bitte um Hilfe