Hi,
als ich mein antivir geupdatet habe und danach virentest gemacht habe kam dies dabei raus:

http://img159.exs.cx/my.php?loc=img1...benannt0xc.jpg

Hab kein Plan davon deswegen dachte ich mir ich wende mich mal wieder an die Profis


Hier noch mein logfile:

Logfile of HijackThis v1.99.0
Scan saved at 20:29:43, on 24.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\PestPatrol\PPControl.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\PestPatrol\PPMemCheck.exe
C:\Programme\PestPatrol\CookiePatrol.exe
C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\ICQLite\ICQLite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\LckFldService.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\explorer.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\mspaint.exe
C:\Dokumente und Einstellungen\Marius\Desktop\rest\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.t-online.de/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programme\FlashFXP\IEFlash.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programme\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\progra~1\valve\steam\steam.exe" -silent
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104950599843
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: LckFldService - Unknown - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RadClock - Unknown - C:\WINDOWS\system32\RadClock.exe
O23 - Service: Sandra Data Service - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcSandraSrv.exe
O23 - Service: Sygate Personal Firewall Pro - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe

Hallo,

in deinem Log-File sehe ich keine Auffälligkeiten diesbezüglich.
Führe zur Sicherheit dies aus ->

Lade und scanne mit eScan AntiVirus im abgesicherten Modus wie beschrieben.
Poste anschliessend die Virus Log Information von eScan AntiVirus:
Öffne die mwav.log im Ordner C:\bases -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.

ok hi danke
aber wie starte ich winxp im abgesicherten Modus??

Zitat von Topsecret

ok hi danke
aber wie starte ich winxp im abgesicherten Modus??

So: http://www.trojaner-board.de/63335-w...s-starten.html

Hi ok habs jetzt gemacht hat auch ganz schön was gefunden (35 stück)

Weis aber net ob ich auch alle übertragen hab denn bin ein bisschen durcheinander gekommen aber müssten so ziemlich alle sein.Hat auch ziemlich lange gedauert.

Hier mal mein Logfile ich hoffe es genügt:

Fri Feb 25 13:35:53 2005 => File J:\WinAce Archiver\Winzip 9.0 Winace 2.5 Winrar 3.30 (Todos En Espaã±Ol).rar infected by "Trojan.Win32.StartPage.sv" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:34:36 2005 => File J:\Style xp 2\74.exe infected by "not-a-virus:AdWare.ToolBar.Quick.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:27:40 2005 => File J:\Codecpack\DivXPro511Adware.exe infected by "not-a-virus:AdWare.Gator.3202" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010645.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010645.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010646.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010646.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010647.exe
Fri Feb 25 13:25:28 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010647.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:24 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010623.EXE
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010623.EXE infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010624.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010624.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010625.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010625.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010626.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010626.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010627.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010627.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010628.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010628.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010630.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010630.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010631.exe
Fri Feb 25 13:25:25 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010631.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:25 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010632.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010632.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010633.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010633.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010634.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010634.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010635.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010635.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010636.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010636.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010637.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010637.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010638.exe
Fri Feb 25 13:25:26 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010638.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:26 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010639.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010639.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010640.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010640.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010641.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010641.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010642.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010642.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010643.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010643.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 13:25:27 2005 => Scanning File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010644.exe
Fri Feb 25 13:25:27 2005 => File E:\System Volume Information\_restore{01056107-37DF-426C-BE76-61B72AA7EA0E}\RP38\A0010644.exe infected by "Virus.Win32.Hidrag.a" Virus. Action Taken: No Action Taken.

Fri Feb 25 11:35:32 2005 => Scanning File C:\HL2\hl2\sound\npc\combine_soldier\vo\infected.wav

Fri Feb 25 11:11:08 2005 => File C:\WINDOWS\system32\wudupdate.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.


Mfg Ich hoffe wir können sie bekämpfen

Dann wollen wir mal...
Alle hier gefundenen Viren (Scanning File E:\System Volume Information\_restore) wirst Du los, indem Du die Systemwiederherstellung deaktivierst, anschließend neu bootest und (bei Bedarf) die Systemwiederherstellung wieder aktivierst s. auch hier: http://www.tu-berlin.de/www/software/virus/sysres.shtml

Den Rest musst Du manuell von Hand löschen, am besten im abgesicherten Modus Deines PC:

J:\WinAce Archiver\Winzip 9.0 Winace 2.5 Winrar 3.30 (Todos En Espaã±Ol).rar <- geht mich nichts an, sieht aber nach einem Download aus einer nicht besonders seriösen Quelle aus...

J:\Style xp 2\74.exe

J:\Codecpack\DivXPro511Adware.exe

C:\WINDOWS\system32\wudupdate.exe

Diesen Eintrag kannst Du ignorieren:

Fri Feb 25 11:35:32 2005 => Scanning File C:\HL2\hl2\sound\npc\combine_soldier\vo\infected.wav

Um sicher zu gehen, dass Du alles erwischt hast, solltest Du eScan im Anschluß noch einmal komplett scannen lassen.