bitte prüfen meine logs

Kaputnixx

smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]

Running from
C:\Dokumente und Einstellungen\GOA LADY\Desktop\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright(C) 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\system32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!

Und hier noch die Escan log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Mar 04 20:03:54 2006 => System found infected with cydoor.topicks.a Spyware/Adware (settings.dat)! Action taken: No Action Taken.
Sat Mar 04 20:04:06 2006 => System found infected with hotbar Spyware/Adware (wbemess.lo_)! Action taken: No Action Taken.
Sat Mar 04 20:03:22 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Mar 04 20:03:23 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Mar 04 20:03:24 2006 => Object "limewire Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Mar 04 20:03:24 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Sat Mar 04 20:17:25 2006 => File C:\Dokumente und Einstellungen\GOA LADY\Anwendungsdaten\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-6b4f88b3.zip infected by "Trojan-Downloader.Java.OpenStream.w" Virus! Action Taken: No Action Taken.
Sat Mar 04 20:26:13 2006 => File C:\Programme\Daily Weather Forecast\weather.exe infected by "Trojan-Downloader.Win32.Centim.an" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Sat Mar 04 20:03:54 2006 => Offending file found: C:\Dokumente und Einstellungen\GOA LADY\Anwendungsdaten\utorrent\settings.dat
Sat Mar 04 20:04:06 2006 => Offending file found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\spybot - search & destroy\backups\wbemess.lo_
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Sat Mar 04 20:40:45 2006 => File C:\Programme\Messenger\Super-Power-Script ST edition\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Sat Mar 04 21:31:23 2006 => File C:\WINDOWS\system32\cmdow.exe tagged as not-a-virus:RiskTool.Win32.HideWindows. No Action Taken.
Sat Mar 04 22:05:56 2006 => File F:\Klingeltöne\Jamba Collection\Jamba Collection\Jamba Collection\Handy Progs\ActiveViewer\vnc-3.3.7-x86_win32.zip tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
Sat Mar 04 22:14:57 2006 => File F:\Klingeltöne\Jamba Collection.rar tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
Sat Mar 04 22:28:09 2006 => File F:\Spiele\JewelQuestSetup-dm.exe tagged as "not-a-virus:AdWare.Win32.Trymedia.b". Action Taken: No Action Taken.
Sat Mar 04 22:28:14 2006 => File F:\Super-Power-Script-ST-Edition-by-Devil\Super-Power-Script ST edition\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Sat Mar 04 22:28:17 2006 => File F:\Super-Power-Script-ST-Edition-by-Devil.rar tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Sat Mar 04 20:03:23 2006 => Offending Folder found: C:\Programme\limewire
Sat Mar 04 20:03:24 2006 => Offending Folder found: C:\Dokumente und Einstellungen\GOA LADY\Anwendungsdaten\limewire
Sat Mar 04 20:03:24 2006 => Offending Folder found: C:\Dokumente und Einstellungen\GOA LADY\Anwendungsdaten\meine die schlacht um mittelerde™ ii-dateien\save
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Sat Mar 04 20:03:16 2006 => Offending Key found: HKLM\Software\magnet\handlers\limewire !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Mar 04 23:05:00 2006 => Total Errors: 48
Sat Mar 04 23:05:00 2006 => Time Elapsed: 03:01:46
Sat Mar 04 23:05:00 2006 => Total Objects Scanned: 97839
Sat Mar 04 20:01:05 2006 => Virus Database Date: 3/3/2006
Sat Mar 04 23:05:00 2006 => Virus Database Date: 3/3/2006
Sun Mar 05 02:10:12 2006 => Virus Database Date: 3/3/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--------------------------------------------------
C:\Dokumente und Einstellungen\GOA LADY\Lokale Einstellungen\Temp\MWAV.LOG

HAbe jetzt schonmal die Limewire Schei... gelöscht, da ich weis das das da nichts zu suchen hatt. ist der Rechner von meiner Frau und ich musses wieder machen. Hoffe ihr könnt mir helfen.
--------------------------------------------------