HighJacker Problem?

BettaSven · 25.06.2005, 13:26

Hallo alle zusammen.

Seit gestern hab ich folgendes Problem.
Mein Internet Explorer öffnet laufend Pop Ups von selbst, desweiteren findet mein Virenscanner einen Virus der sich nur "Trojan Horse" nennt. Mein Internetexplorer hat seit neuestem eine neue Startseite und in meinen Favoriten hab ich laufend neue Links gespeichert.

Ich hab mal ein Logfile von HijackThis erstellen lassen.

Logfile of HijackThis v1.99.1
Scan saved at 14:13:02, on 25.06.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Norton Internet Security\ISSVC.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\NETGEAR\WG311TSU\Utility\Gear311T.exe
D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\ctfmon.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\Programme\DV Series\Console\Watch.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\msfe.exe
D:\Nokia\NOKIAP~1\VFSWRA~1.EXE
D:\AOL 9.0\waol.exe
D:\AOL 9.0\shellmon.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
I:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\lkkzu.dll/sp.html#12047
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: GDS module - {A084A565-B09B-4e4c-A497-7CC50AEAB2A7} - C:\WINDOWS\gds5.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {DD5394B0-238F-DA76-6C71-E9FE22E42CC1} - C:\WINDOWS\ntbz32.dll
O2 - BHO: Class - {E2FF7285-6F6F-9283-CBCD-D4E370856A52} - C:\WINDOWS\ntbz32.dll
O2 - BHO: Class - {F05AEE59-1D1C-D18A-A8AF-CA446E213233} - C:\WINDOWS\ntbz32.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] D:\Norton\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] D:\Brenner\InCD.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CloneCDTray] "D:\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VRPalmFightFish] E:\bettabetta\????.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AS00_Gear311T] C:\Programme\NETGEAR\WG311TSU\Utility\Gear311T.exe -hide
O4 - HKLM\..\Run: [iTunesHelper] D:\i-tunes\iTunesHelper.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [crsg.exe] C:\WINDOWS\crsg.exe
O4 - HKLM\..\Run: [netue.exe] C:\WINDOWS\system32\netue.exe
O4 - HKLM\..\Run: [sysos.exe] C:\WINDOWS\sysos.exe
O4 - HKLM\..\Run: [msfe.exe] C:\WINDOWS\msfe.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [AIM] F:\Programme\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Programme\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PcSync] D:\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Tray-Symbol.lnk = D:\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Watch.lnk = C:\Programme\DV Series\Console\Watch.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - d:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - d:\Programme\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Programme\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\Programme\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: concept/design's onlineTV - {FFD99A02-B23A-48AA-8C78-8F5F2E8A9E83} - D:\onlineTV\onlineTV.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://h**p://game18.zylomgames.com/...amesplayer.cab
O16 - DPF: {D67AC55A-B750-41A4-BEE6-020E017A7996} - http://h**p://www.popfile.de/myplayl...LER_loader.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{4980117F-88F3-452C-BE06-1B7D6CC49A79}: NameServer = 192.170.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{788218A8-6172-4586-A364-FED3CB9C5884}: NameServer = 192.168.0.1
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programme\Norton Internet Security\ISSVC.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - D:\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Kann mir jemand sagen welche Auswirkungen der Trojaner noch haben kann und wie ich ihn löschen kann? Kann es sein das durch ihn irgendwelche Kosten entstanden sind? Ich hab eine DSL Leitung. Wenn ich versuch den Trojaner über Norton Antivirus zu löschen kommt er laufend mit einem neuen Namen wieder.

Mfg.
Sven

cronos · 25.06.2005, 15:22

Interesssant wäre gewesen, wo Norton den Trojaner findet und wie er ihn nennt.Nun gut, gehe wie folgt cor:
Scanne dein System im abgesicherten Modus mit Escan. Halte dich dabei bitte genauestens an die Anleitung und teile uns anschliessend die Ergebnisse mit.

BettaSven · 25.06.2005, 15:55

Hallo cronos

Ok werde ich gleich Probieren.
Er findet die Datei in C:\Windows\system32\

Gruß Sven

BettaSven · 25.06.2005, 17:55

Hallo cronos

So jetzt ist er endlich mit scannen fertig.
Er hat mir angezeigt, dass er den Virus 75 mal gefunden hat.

Wenn bei meinem Virenscanner der Hinweis kommt "Virus Warnung" zeigt er auch jedesmal eine neue Datei an. jetzt ist es z.B. C:\Windows\system32\ntkz.exe

Gruß Sven

Cidre · 25.06.2005, 20:46

Zitat:

Er hat mir angezeigt, dass er den Virus 75 mal gefunden hat.

Jetzt sind wir genauso schlau wie vorher.

Poste doch einfach die Virus Log Information so, wie es auch in der Anleitung beschrieben wird.

Wende danach den Cleaner an und beseitige die restliche Malware manuell...

BettaSven · 26.06.2005, 21:39

Hallo alle zusammen,

Ich hab den Cleaner gestartet. Allerdings seh ich keinen Fortschritt. Der Rechner startet auch nicht neu.

Hier sind die Log´s vom Cleaner.
---------------------------
(26.6.05 22:25:59) SPSeHjFix started v1.1.2
(26.6.05 22:25:59) OS: WinXP Service Pack 1 (5.1.2600)
(26.6.05 22:25:59) Language: deutsch
(26.6.05 22:25:59) Win-Path: C:\WINDOWS
(26.6.05 22:25:59) System-Path: C:\WINDOWS\System32
(26.6.05 22:25:59) Temp-Path: C:\DOKUME~1\Sven\LOKALE~1\Temp\
(26.6.05 22:26:05) Disinfection started
(26.6.05 22:26:05) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll
(26.6.05 22:26:05) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:26:05) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:26:05) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047
(26.6.05 22:26:05) Stealth-String not found
(26.6.05 22:26:05) No locked Files to delete. End without Reboot
(26.6.05 22:26:15) Disinfection started
(26.6.05 22:26:15) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll
(26.6.05 22:26:15) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:26:15) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:26:15) Bad IE-pages: (none)
(26.6.05 22:26:15) Stealth-String not found
(26.6.05 22:26:15) No locked Files to delete. End without Reboot

(26.6.05 22:27:24) SPSeHjFix started v1.1.2
(26.6.05 22:27:24) OS: WinXP Service Pack 1 (5.1.2600)
(26.6.05 22:27:24) Language: deutsch
(26.6.05 22:27:24) Win-Path: C:\WINDOWS
(26.6.05 22:27:24) System-Path: C:\WINDOWS\System32
(26.6.05 22:27:24) Temp-Path: C:\DOKUME~1\Sven\LOKALE~1\Temp\
(26.6.05 22:27:25) Disinfection started
(26.6.05 22:27:25) Bad-Dll(IEP): c:\windows\system32\lkkzu.dll
(26.6.05 22:27:25) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:27:25) UBF: 4 - UBB: 3 - UBR: 28
(26.6.05 22:27:25) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\lkkzu.dll/sp.html#12047
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\lkkzu.dll/sp.html#12047
(26.6.05 22:27:25) Stealth-String not found
(26.6.05 22:27:25) No locked Files to delete. End without Reboot
----------------------------

Wenn ich die Logs von Escan hier einfügen möchte oder Anhängen möchte kommt ein Fehler.

Gruß Sven

Cidre · 26.06.2005, 21:49

Wenn du den kompletten Inhalt der mwav.log hier posten oder anhängen willst, dann ist dies klar.
Poste nur den Inhalt der 'C:\eScan_neu.txt'.

BettaSven · 26.06.2005, 21:53

Hallo,

Das hab ich probiert.
Ich probier es nochmal.

Gruß Sven

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sat Jun 25 17:01:15 2005 => File C:\WINDOWS\ntbz32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:01:25 2005 => File C:\WINDOWS\gds5.dll infected by "Trojan-Downloader.Win32.Small.azf" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:01:25 2005 => File C:\WINDOWS\ntbz32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:01:35 2005 => File C:\WINDOWS\msfe.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:01:55 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sat Jun 25 17:02:52 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Sat Jun 25 17:10:22 2005 => File C:\DOKUME~1\Sven\LOKALE~1\TEMPOR~1\Content.IE5\U327QLIZ\ss_stopsign[1].exe infected by "Trojan-Downloader.Win32.Wren.i" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:20:32 2005 => File C:\Dokumente und Einstellungen\Sven\Lokale Einstellungen\Temporary Internet Files\Content.IE5\U327QLIZ\ss_stopsign[1].exe infected by "Trojan-Downloader.Win32.Wren.i" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:20:53 2005 => File C:\ms32.tmp infected by "Trojan-Downloader.Win32.Small.azk" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0118178B.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\123B09B8.tmp infected by "Email-Worm.Win32.Mabutu.a" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29310685.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29353081.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\294F0064.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29A44407.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29CB3BDC.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\29DE37C6.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2FA4736F.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\479F02CD.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\47A656C6.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\47F44670.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4812404F.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4822123D.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6D9473CA.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6D9D71C0.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6DAE43AE.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6DBE159C.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E1A2D37.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E6572E4.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E7B18CB.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6E8940BD.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:24:48 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6F2C7409.htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171224.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171225.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:25:23 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171240.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus! Action Taken: No Action Taken.
Sat Jun 25 17:46:55 2005 => File D:\Kampffisch-Game.exe infected by "P2P-Worm.Win32.Franvir" Virus! Action Taken: No Action Taken.
Sat Jun 25 18:06:17 2005 => File E:\sortieren\Kampffisch-Game.exe infected by "P2P-Worm.Win32.Franvir" Virus! Action Taken: No Action Taken.
Sat Jun 25 18:30:47 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sat Jun 25 17:04:18 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:05:12 2005 => File C:\WINDOWS\System32\lkkzu.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:07:54 2005 => File C:\DOKUME~1\Sven\LOKALE~1\Temp\SFX3F1.tmp\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:18:21 2005 => File C:\Dokumente und Einstellungen\Sven\Lokale Einstellungen\Temp\SFX3F1.tmp\TDM\TDMInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:21:35 2005 => File C:\Programme\DV Series\Uninstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:24:45 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\00FA02C8.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\098D3959.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:24:46 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2FA4736F.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4C2106F1.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:24:47 2005 => File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\63BC2A65.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:25:20 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171173.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:25:22 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171222.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:25:23 2005 => File C:\System Volume Information\_restore{CFBF59A3-153F-4E79-9670-A4A8F5DB5C12}\RP540\A0171239.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:36:31 2005 => File C:\WINDOWS\system32\lkkzu.dll tagged as "not-a-virus:AdWare.SearchPage". Action Taken: No Action Taken.
Sat Jun 25 17:36:38 2005 => File C:\WINDOWS\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:38:45 2005 => File C:\WINDOWS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:41:43 2005 => File D:\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:54:46 2005 => File D:\Programme\Lavasoft\Ad-aware 6\Lang\Language-pack 2\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:54:46 2005 => File D:\Programme\Lavasoft\Ad-aware 6\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:56:32 2005 => File D:\Programme\Pixelnet\Pixel2Picture\Unwise.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:56:38 2005 => File D:\Programme\Yahoo!\Installs\ymsgrie.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 17:57:05 2005 => File D:\Programme\Yahoo!\Messenger\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:01:33 2005 => File E:\Auslagerung Temp (Windows)\AOL\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:02:58 2005 => File E:\Fun Bilder\Flash\gun.exe tagged as not-a-virus:Effect.Win16.Gun. No Action Taken.
Sat Jun 25 18:03:09 2005 => File E:\Fun Bilder\Programme\Langeweile1_1.exe tagged as not-a-virus:Joke.Win32.Langeweile. No Action Taken.
Sat Jun 25 18:07:45 2005 => File F:\Programme\AIM95\unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:24:12 2005 => File I:\Downloads\menuorc5.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:12 2005 => File I:\Downloads\Software\Internet\Addaware 6.0\aaw-lang-pack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:12 2005 => File I:\Downloads\Software\Internet\Addaware 6.0\aaw6.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:24 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:28 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde1.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:32 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:27:36 2005 => File I:\Downloads\Software\Internet\Messenger\Yahoo Messenger\ymsgrde3.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Sat Jun 25 18:28:14 2005 => File I:\Downloads\Spiele\Mini Spiele\sharkattack.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Sat Jun 25 18:30:47 2005 => Total Virus(es) Found: 75
Sat Jun 25 18:30:47 2005 => Total Errors: 210
Sat Jun 25 18:30:47 2005 => Time Elapsed: 01:29:47
Sat Jun 25 18:30:47 2005 => Total Objects Scanned: 197284
Sat Jun 25 17:00:43 2005 => Virus Database Date: 2005/06/24
Sat Jun 25 18:30:47 2005 => Virus Database Date: 2005/06/24
Sat Jun 25 18:43:54 2005 => Virus Database Date: 2005/06/24
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

BettaSven · 27.06.2005, 19:09

Hallo alle zusammen

Das Problem besteht weiterhin.
Ich hab jetzt mit verschiedenen Viren Scannern mein System gescannt. Hab auch immer die Datei welche der Trojaner erstellt entfernen können. Aber sobald ich länger im Internet bin oder den Internet Explorer öffne kommt eine neue Virenmeldung.

Gruß Sven

------------------
Ich hab mit der neuesten Version von Ad Aware meinen PC durchsucht und noch etwas gefunden was sich CoolWebsearch nennt. Wenn ich es mit Ad Aware lösche kommt es beim nächsten Überprüfen wieder.

BettaSven · 30.06.2005, 20:52

Hallo alle zusammen

Danke für eure Hilfe.
Ich habe das Problem jetzt behoben.

Gruß Sven

Cidre · 30.06.2005, 20:57

Hallo BettaSven,

dann wäre es für uns und andere Hilfesuchenden sicherlich interessant, wenn du uns mitteilen würdest, was letztendlich zum Erfolg führte.

26.06.2005, 21:49	#7
Cidre Administrator, a.D.	HighJacker Problem? Wenn du den kompletten Inhalt der mwav.log hier posten oder anhängen willst, dann ist dies klar. Poste nur den Inhalt der 'C:\eScan_neu.txt'. __________________ Gruß, Cidre [B]Neuaufsetzen des Systems/Absicherung - Wie poste ich falsch?

30.06.2005, 20:57	#11
Cidre Administrator, a.D.	HighJacker Problem? Hallo BettaSven, dann wäre es für uns und andere Hilfesuchenden sicherlich interessant, wenn du uns mitteilen würdest, was letztendlich zum Erfolg führte. __________________ Gruß, Cidre [B]Neuaufsetzen des Systems/Absicherung - Wie poste ich falsch?

HighJacker Problem?

Log-Analyse und Auswertung: HighJacker Problem?