Tach mein Antivirguard hatte mir vorgestern erstmals eine Warnung verfasst
da stand dann irgendwas von

Dropper DR Solutions
und
Trojaner TR/Dldr.Dyfuca.ds

Könnt ihr mir helfen dat zu beheben ?
Habe schon versucht die Dateien (salm.exe??) zu löschen geht aber nicht !
Kann dat Problem auch nit mit Antivir beheben !

Bin Neuling also habt gewisse rücksicht mit mir !!!
vielen Dank im vorraus !!!!


Logfile of HijackThis v1.99.1
Scan saved at 15:22:49, on 10.05.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\QuickTime\qttask.exe
C:\Dokumente und Einstellungen\Sebastian\Eigene Dateien\Programm Downloads\Musikprogramme\Winamp\Winampa.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Program Files\Media Access\MediaAccess.exe
C:\Programme\AVPersonal\AVSCHED32.EXE
C:\WINDOWS\System32\gah95on6.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Lexmark X125\LEX125SU.exe
C:\Programme\AOL 8.0\waol.exe
C:\Programme\AOL 8.0\shellmon.exe
C:\Programme\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Dokumente und Einstellungen\Sebastian\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis_199.zip\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NAV_Update] C:\NAV_Update.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Dokumente und Einstellungen\Sebastian\Eigene Dateien\Programm Downloads\Musikprogramme\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSCHED32.EXE /min
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: Lexmark X125 Einstellungsdienstprogramm.lnk = C:\Programme\Lexmark X125\LEX125SU.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CD...ridge-c139.cab
O16 - DPF: {A8482EAF-A1F3-4934-AE3F-56EB195A50BF} (DeskUpdateV3 - Activex Control) - http://support.fujitsu-siemens.de/De...pi/activex.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7EA6EC3-74E7-4A51-A00F-571E56E0C077}: NameServer = 205.188.146.145
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: GEARSecurity - Unknown owner - C:\WINDOWS\SYSTEM32\GEARSEC.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Bei escan stand am ende


Mon May 09 22:14:17 2005 => Total Objects Scanned: 81236
Mon May 09 22:14:17 2005 => Total Virus(es) Found: 31
Mon May 09 22:14:17 2005 => Total Disinfected Files: 0
Mon May 09 22:14:17 2005 => Total Files Renamed: 0
Mon May 09 22:14:17 2005 => Total Deleted Objects: 0
Mon May 09 22:14:17 2005 => Total Errors: 8
Mon May 09 22:14:17 2005 => Time Elapsed: 00:58:51
Mon May 09 22:14:17 2005 => AV Library Unloaded (3)...
Mon May 09 22:15:15 2005 => **********************************************************
Mon May 09 22:15:15 2005 => MicroWorld AntiVirus & Spyware Toolkit Utility.
Mon May 09 22:15:15 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc.
Mon May 09 22:15:15 2005 => **********************************************************
Mon May 09 22:15:15 2005 => Version 6.1.7 (C:\bases_x\mwavscan.com)
Mon May 09 22:15:15 2005 => Log File: C:\bases_x\MWAV.LOG
Mon May 09 22:15:15 2005 => Last Scan Date and Time: 09.05.2005 20:49:47
Mon May 09 22:15:15 2005 => MWAV Registered: FALSE.
Mon May 09 22:15:15 2005 => MWAV Mode: Only Scan files.
Mon May 09 22:15:15 2005 => Latest Date of files inside MWAV: 05 May 2005 11:32:43.
Mon May 09 22:15:19 2005 => AV Library Loaded...
Mon May 09 22:15:19 2005 => MWAV doing self scanning...
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\kavss.exe
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\Getvlist.exe
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\kavss.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\kavssdi.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\kavssi.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\kavvlg.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\msvlclnt.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\ipc.dll
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\main.avi
Mon May 09 22:15:19 2005 => Scanning File C:\bases_x\virus.avi
Mon May 09 22:15:19 2005 => MWAV files are clean.
Mon May 09 22:15:24 2005 => MWAV License Agreement and conditions NOT accepted by user. Aborting...
Mon May 09 22:15:24 2005 => AV Library Unloaded (2)...
Mon May 09 22:25:29 2005 => **********************************************************
Mon May 09 22:25:29 2005 => MicroWorld AntiVirus & Spyware Toolkit Utility.
Mon May 09 22:25:29 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc.
Mon May 09 22:25:29 2005 => **********************************************************
Mon May 09 22:25:29 2005 => Version 6.1.7 (C:\bases_x\mwavscan.com)
Mon May 09 22:25:29 2005 => Log File: C:\bases_x\MWAV.LOG
Mon May 09 22:25:29 2005 => Last Scan Date and Time: 09.05.2005 20:49:47
Mon May 09 22:25:29 2005 => MWAV Registered: FALSE.
Mon May 09 22:25:29 2005 => MWAV Mode: Only Scan files.
Mon May 09 22:25:29 2005 => Latest Date of files inside MWAV: 05 May 2005 11:32:43.
Mon May 09 22:25:30 2005 => AV Library Loaded...
Mon May 09 22:25:30 2005 => MWAV doing self scanning...
Mon May 09 22:25:30 2005 => Scanning File C:\bases_x\kavss.exe
Mon May 09 22:25:30 2005 => Scanning File C:\bases_x\Getvlist.exe
Mon May 09 22:25:30 2005 => Scanning File C:\bases_x\kavss.dll
Mon May 09 22:25:30 2005 => Scanning File C:\bases_x\kavssdi.dll
Mon May 09 22:25:30 2005 => Scanning File C:\bases_x\kavssi.dll
Mon May 09 22:25:31 2005 => Scanning File C:\bases_x\kavvlg.dll
Mon May 09 22:25:31 2005 => Scanning File C:\bases_x\msvlclnt.dll
Mon May 09 22:25:31 2005 => Scanning File C:\bases_x\ipc.dll
Mon May 09 22:25:31 2005 => Scanning File C:\bases_x\main.avi
Mon May 09 22:25:31 2005 => Scanning File C:\bases_x\virus.avi
Mon May 09 22:25:31 2005 => MWAV files are clean.
Mon May 09 22:25:34 2005 => Virus Database Date: 2005/05/05
Mon May 09 22:25:34 2005 => Virus Database Count: 128422
Mon May 09 22:27:40 2005 => Generating Virus List... getvlist.exe C:\bases_x\vlist.txt
Mon May 09 22:28:05 2005 => Generating Virus List... getvlist.exe C:\bases_x\vlist.txt
Mon May 09 22:28:19 2005 => AV Library Unloaded (3)...

_____________
Anm.
Das nächste Mal bitte einen sinnvollen Thread Titel erstellen.

LG Cidre
S-Mod TB

Teile uns die Ergebnie des Escan diesmal richtig mit,dazu

Zitat von haui45

Speichere außerdem diese Datei mittels Rechtsklick-> "Ziel speichern unter..." auf deiner Festplatte. Führe sie nach dem Scan mit eScan aus (Doppelklick). Danach solltest du die Datei C:\eScan_neu.txt auf deiner Festplatte finden. Den Inhalt dieser Datei postest du dann bitte in diesen Thread.

was ist denn das für ne datei ?

Danke werd ich machen !

also wenn ich dat richtig verstehe soll ich den escan nochmals ausführen und dann diese Datei die ich grad runtergeleden hab nach beendigung des escans in den tread kopieren !? richtig ?

Nein, führe die Find.bat einfach aus (Doppelklick). Danach findest du die Datei c:\eScan_neu.txt auf deiner Festplatte. Den Inhalt dieser Textdatei postest du.

Mon May 09 20:55:03 2005 => File C:\WINDOWS\System32\2b3fsk0h.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:05 2005 => File c:\temp\salmhook.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:09 2005 => File C:\temp\salm.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:10 2005 => File C:\WINDOWS\System32\gah95on6.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:39 2005 => File c:\temp\salm.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:39 2005 => File C:\WINDOWS\System32\gah95on6.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:52 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Mon May 09 20:55:52 2005 => File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:52 2005 => System found infected with BlazeFind Spyware/Adware ({15ad4789-cdb4-47e1-a9da-992ee8e6bad6})! Action taken: No Action Taken.
Mon May 09 20:55:52 2005 => File System Found infected by "BlazeFind Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:53 2005 => System found infected with DyFuCA Spyware/Adware! Action taken: No Action Taken.
Mon May 09 20:55:53 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:53 2005 => System found infected with ameopt Spyware/Adware! Action taken: No Action Taken.
Mon May 09 20:55:53 2005 => File System Found infected by "ameopt Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:53 2005 => System found infected with kapabout Spyware/Adware! Action taken: No Action Taken.
Mon May 09 20:55:53 2005 => File System Found infected by "kapabout Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:53 2005 => System found infected with 180Solutions Spyware/Adware! Action taken: No Action Taken.
Mon May 09 20:55:53 2005 => File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:55:53 2005 => System found infected with 180Solutions Spyware/Adware! Action taken: No Action Taken.
Mon May 09 20:55:53 2005 => File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:19 2005 => System found infected with WindUpdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken.
Mon May 09 20:56:19 2005 => File System Found infected by "WindUpdate Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:19 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Mon May 09 20:56:19 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:20 2005 => File C:\WINDOWS\70tovmto.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:24 2005 => File C:\WINDOWS\ratgeber[rgf-10006,de,clairin].exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:28 2005 => File C:\WINDOWS\System32\2b3fsk0h.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Mon May 09 20:56:33 2005 => File C:\WINDOWS\System32\bln02nqv.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 21:16:47 2005 => File C:\Program Files\Media Pass\MediaPassC.dll infected by "not-a-virus:AdWare.WinAD.ac" Virus. Action Taken: No Action Taken.
Mon May 09 21:18:17 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
Mon May 09 21:18:45 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\SALM.EXE.TMP.VIR [**]
Mon May 09 21:29:16 2005 => C:\RECYCLER\S-1-5-21-1149294280-1422476694-4050619429-1006\Dc20\salm.exe possibly infected and removed by background antivirus package!
Mon May 09 21:29:16 2005 => File C:\RECYCLER\S-1-5-21-1149294280-1422476694-4050619429-1006\Dc20\salm.exe infected by "BkCln.Unknown" Virus. Action Taken: No Action Taken.
Mon May 09 21:29:43 2005 => File C:\System Volume Information\_restore{2698B85B-313D-4B30-A825-1412353E6E30}\RP109\A0027392.exe infected by "not-a-virus:AdWare.WinAD.ac" Virus. Action Taken: No Action Taken.
Mon May 09 21:29:43 2005 => File C:\System Volume Information\_restore{2698B85B-313D-4B30-A825-1412353E6E30}\RP109\A0027393.exe infected by "not-a-virus:AdWare.WinAD.ab" Virus. Action Taken: No Action Taken.
Mon May 09 21:31:33 2005 => File C:\temp\salmhook.dll infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
Mon May 09 21:31:38 2005 => File C:\WINDOWS\70tovmto.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 21:32:07 2005 => File C:\WINDOWS\Coder\_1-dow-1-0-.exe infected by "not-a-virus:Porn-Dialer.Win32.ALifeDialer" Virus. Action Taken: No Action Taken.
Mon May 09 21:39:45 2005 => File C:\WINDOWS\ratgeber[rgf-10006,de,clairin].exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken.
Mon May 09 21:40:00 2005 => File C:\WINDOWS\system32\2b3fsk0h.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Mon May 09 21:40:06 2005 => File C:\WINDOWS\system32\bln02nqv.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Mon May 09 21:48:38 2005 => Total Disinfected Files: 0
Mon May 09 22:14:17 2005 => Total Disinfected Files: 0
Tue May 10 16:13:14 2005 => File C:\WINDOWS\System32\2b3fsk0h.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Tue May 10 16:13:26 2005 => File C:\WINDOWS\System32\gah95on6.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:03 2005 => File c:\temp\salm.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:03 2005 => File C:\WINDOWS\System32\gah95on6.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:14 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Tue May 10 16:14:14 2005 => File System Found infected by "Alexa Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:14 2005 => System found infected with BlazeFind Spyware/Adware ({15ad4789-cdb4-47e1-a9da-992ee8e6bad6})! Action taken: No Action Taken.
Tue May 10 16:14:14 2005 => File System Found infected by "BlazeFind Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:15 2005 => System found infected with DyFuCA Spyware/Adware! Action taken: No Action Taken.
Tue May 10 16:14:15 2005 => File System Found infected by "DyFuCA Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:15 2005 => System found infected with ameopt Spyware/Adware! Action taken: No Action Taken.
Tue May 10 16:14:15 2005 => File System Found infected by "ameopt Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:15 2005 => System found infected with kapabout Spyware/Adware! Action taken: No Action Taken.
Tue May 10 16:14:15 2005 => File System Found infected by "kapabout Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:15 2005 => System found infected with 180Solutions Spyware/Adware! Action taken: No Action Taken.
Tue May 10 16:14:15 2005 => File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:15 2005 => System found infected with 180Solutions Spyware/Adware! Action taken: No Action Taken.
Tue May 10 16:14:15 2005 => File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:21 2005 => System found infected with WindUpdate Spyware/Adware (ide21201.vxd)! Action taken: No Action Taken.
Tue May 10 16:14:21 2005 => File System Found infected by "WindUpdate Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:22 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Tue May 10 16:14:22 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:23 2005 => File C:\WINDOWS\70tovmto.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:30 2005 => File C:\WINDOWS\ratgeber[rgf-10006,de,clairin].exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:35 2005 => File C:\WINDOWS\System32\2b3fsk0h.dll infected by "not-a-virus:AdWare.Sahat.l" Virus. Action Taken: No Action Taken.
Tue May 10 16:14:41 2005 => File C:\WINDOWS\System32\bln02nqv.exe infected by "not-a-virus:AdWare.Sahat.o" Virus. Action Taken: No Action Taken.
Tue May 10 16:17:47 2005 => Scanning Folder: C:\bases_x\infected\*.*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon May 09 21:14:47 2005 => File C:\isp\AOL_Mediamarkt\INSTALL\HB\chipklsr\orga\SETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon May 09 21:14:53 2005 => File C:\isp\AOL_Mediamarkt\INSTALL\HB\REDIST\MSVBVM50.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon May 09 21:48:38 2005 => Total Virus(es) Found: 31
Mon May 09 22:14:17 2005 => Total Virus(es) Found: 31
Mon May 09 21:48:38 2005 => Total Errors: 8
Mon May 09 22:14:17 2005 => Total Errors: 8
Mon May 09 21:48:38 2005 => Time Elapsed: 00:58:51
Mon May 09 22:14:17 2005 => Time Elapsed: 00:58:51
Mon May 09 21:48:38 2005 => Total Objects Scanned: 81236
Mon May 09 22:14:17 2005 => Total Objects Scanned: 81236
Mon May 09 21:48:38 2005 => Virus Database Date: 2005/05/05
Mon May 09 22:25:34 2005 => Virus Database Date: 2005/05/05
Tue May 10 16:12:11 2005 => Virus Database Date: 2005/05/05
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

hab es getan !

Lade dir zunächst CWSShredder, Adaware,Clearprog und Spybot .

Wechsle in den abgesicherten Modus bei deaktivierter Systemwiederherstellung:

http://www.systemwiederherstellung-d...indows-xp.html

Lasse jetzt alle gedownloadeten Programme durchlaufen.Und behebe Probleme.
Mit Spybot zusätzlich noch immunisieren.

Lösche manuell den Inhalt folgenden Ordners:

C:\Programme\AVPersonal\INFECTED

Lösche weiterhin folgende Ordner:

C:\WINDOWS\System32\2b3fsk0h.dll
c:\temp
C:\WINDOWS\System32\gah95on6.exe
C:\WINDOWS\70tovmto.exe
C:\WINDOWS\ratgeber[rgf-10006,de,clairin].exe
(die letzte evtl. noch auf Diskette sichern zwecks Beweissicherung bei überhöhter Telefonrechnung)
C:\WINDOWS\System32\2b3fsk0h.dll
C:\WINDOWS\System32\bln02nqv.exe
C:\Program Files\Media Pass
C:\RECYCLER
C:\WINDOWS\Coder\_1-dow-1-0-.exe
(auch sichern)
C:\WINDOWS\Coder
C:\WINDOWS\system32\bln02nqv.exe

mittels Killbox:

Zitat von cidre

Lade und öffne KillBox. Kopiere den Pfad der Malware Datei z.B. C:\WINDOWS\system32\fltmgr.dll -> füge diesen in KillBox ein -> wähle die Option 'Delete on reboot' -> rotes X anklicken -> die zwei folgenden Fragen mit 'JA' und 'NEIN' beantworten -> nächsten Pfad einfügen usw. -> wenn du bei der letzten Datei angekommen bist, dann beantworte beide Fragen mit 'JA' und ein Neustart deines Systems wird durchgeführt.

.
Systemwiederherstellung einschalten nachdem alles getan ist, nicht vergessen.
Anschliessend neuen HJT-Log posten

vielen dank erstmal !!!!

werd es gleich ausprobieren

was habe ich denn nun alles auf meinem PC ???

trojaner, dialer, spyware oder was ?

habe alle anweisungen erfolgt !!!

aber habe übersehen das ich ja die restlichen Dateien mittels Killbox ( hatte ich nicht runtergeladen) löschen sollte !!!

nun hab ich sie auch manuell gelöscht im abgesicherten modus !!!!

allerdings glaube ich das diese komische salm.exe immer noch da ist und schaden anrichtet !?

hier mein neuer logfile

Logfile of HijackThis v1.99.1
Scan saved at 00:31:03, on 11.05.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\QuickTime\qttask.exe
C:\Dokumente und Einstellungen\Ralf\Eigene Dateien\Programm Downloads\Musikprogramme\Winamp\Winampa.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Program Files\Media Access\MediaAccess.exe
C:\Programme\AVPersonal\AVSCHED32.EXE
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Lexmark X125\LEX125SU.exe
C:\Dokumente und Einstellungen\Ralf\Lokale Einstellungen\Temp\Temporäres Verzeichnis 3 für hijackthis_199.zip\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\TROJAN~1.DE\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NAV_Update] C:\NAV_Update.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Dokumente und Einstellungen\Ralf\Eigene Dateien\Programm Downloads\Musikprogramme\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSCHED32.EXE /min
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: Lexmark X125 Einstellungsdienstprogramm.lnk = C:\Programme\Lexmark X125\LEX125SU.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CD...ridge-c139.cab
O16 - DPF: {A8482EAF-A1F3-4934-AE3F-56EB195A50BF} (DeskUpdateV3 - Activex Control) - http://support.fujitsu-siemens.de/De...pi/activex.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: GEARSecurity - Unknown owner - C:\WINDOWS\SYSTEM32\GEARSEC.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

wie siehts aus ?

Kann mir jemand erzählen ob alles in ordnung ist.

Danke soweit !

Also es ist noch nicht alles in Ordnung.

Wechsle in den abgesicherten Modus bei deaktivierter Systemwiederherstellung und fixe mit HijackThis folgende Einträge :

O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/C...Bridge-c139.cab

Lösche dann :
c:\temp
C:\Program Files\Media Access
C:\WINDOWS\System32\gah95on6.exe

Neu booten, Systemwiederherstellung anschalten, neues Logfile erstellen

Edit:

BTW:
Du solltest dir dringenst mal Service Pack 2 draufspielen:

http://www.microsoft.com/downloads/d...DisplayLang=de

danke dir für die antwort !

werd es gleich ausprobieren

hab alles so ausgeführt wie beschrieben

aber

c:\windows\system32\gah95on6.exe

war nicht zu finden, sondern nur mit .ini am ende !!!!
hab die ini datei jetzt gelöscht !!!

hier mein logfile

Logfile of HijackThis v1.99.1
Scan saved at 19:35:15, on 11.05.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\QuickTime\qttask.exe
C:\Dokumente und Einstellungen\Ralf\Eigene Dateien\Programm Downloads\Musikprogramme\Winamp\Winampa.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\AVPersonal\AVSCHED32.EXE
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Lexmark X125\LEX125SU.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Dokumente und Einstellungen\Ralf\Lokale Einstellungen\Temp\Temporäres Verzeichnis 4 für hijackthis_199.zip\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

Bitte den kompletten Logfile posten, dass du das kannst hast du ja schon bewiesen