C:\Programme\...\SEINST.EXE Was tun?

Kathiii · 22.04.2006, 12:04

Hallo!!!

Mein Virus Programm findet folgendes "unerwünschte Programm oder Virus" auf meinem PC: C:\Programme\...\SEINST.EXE Außerdem folgende Info: Enthält Signatur des Droppers DR/WindowsEnhancer.A.1
Was soll ich nun machen? Kenne mich leider mit Pc nicht so gut aus. Wäre nett, wenn mir jemand helfen könnte!
Danke!

Vor einiger Zeit fand mein Virusprogramm einen "Bloodhound", dieses Problem hat hoffentlich ein Freund von mir richtig erledigt, wissen wir aber nicht genau.

Schönen Samstag

Bye Kathi

irrlicht · 22.04.2006, 12:55

Hallo Kathii,
erst einmal das,daraus ergibt sich dann weiteres...
http://www.trojaner-board.de/showthread.php?t=17493
Irrlicht

Kathiii · 22.04.2006, 13:21

Habe die Anleitung befolgt.
Hier ist mein Log

Logfile of HijackThis v1.99.1
Scan saved at 14:16:16, on 22.04.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\sstray.exe
C:\WINDOWS\Dit.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\DitExp.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\22M WLAN\WLANMON.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\AntiVir PersonalEdition Classic\avcenter.exe
C:\Programme\AntiVir PersonalEdition Classic\avscan.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\notepad.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
M:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.bild.t-online.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.search-exe.com/nph-search.cgi?tcode=exebar1&look=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Programme\se\v11\se.DLL (file missing)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - J:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: WebBho Class - {00041A26-7033-432C-94C7-6371DE343822} - C:\Programme\se\v11\se.DLL (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Programme\MediaLoads Enhanced\ME2.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_3_12_0.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - J:\Programme\ICQToolbar\toolbaru.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MediaLoads Installer] "C:\Programme\DownloadWare\dw.exe" /H
O4 - HKLM\..\Run: [ICQ Lite] J:\Programme\ICQLite 2\ICQLite.exe -minimize
O4 - HKLM\..\Run: [Search-Exe] "C:\Programme\se\v11\se.EXE" /H
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] J:\Programme\ICQLite 2\ICQLite.exe -trayboot
O4 - Global Startup: 22M WLAN Adapter Utility.lnk = C:\Programme\22M WLAN\WLANMON.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &ICQ Toolbar Search - res://J:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: &Translate English Word - res://c:\programme\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\programme\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - J:\Programme\ICQLite 2\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - J:\Programme\ICQLite 2\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.bild.t-online.de
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/DE/install.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.255.127.85/AxisCamControl.ocx
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game07.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_3_12_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{54218D6B-2B1D-4BAE-A6C4-A2F28E7F1148}: NameServer = 192.168.10.1
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

Hoffe man kann mir jetzt weiterhelfen.
Danke schonmal

Bye Kathi

cosinus · 22.04.2006, 13:29

Zitat:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Dein System ist nicht auf dem aktuellen Patchstatus, mindestens das SP fehlt!

Zitat:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.search-exe.com/nph-search.cgi?tcode=exebar1&look=sbar1_srchbtn
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-search.cgi?tcode=exesrch1&look=stmpl1&fw=
R3 - URLSearchHook: WebSearch Class - {9368D063-44BE-49B9-BD14-BB9663FD38FC} - C:\Programme\se\v11\se.DLL (file missing)
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - J:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: WebBho Class - {00041A26-7033-432C-94C7-6371DE343822} - C:\Programme\se\v11\se.DLL (file missing)
O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Programme\MediaLoads Enhanced\ME2.DLL (file missing)
O4 - HKLM\..\Run: [MediaLoads Installer] "C:\Programme\DownloadWare\dw.exe" /H
O4 - HKLM\..\Run: [Search-Exe] "C:\Programme\se\v11\se.EXE" /H

Diese Einträge kannst Du mit HijackThis fixen.
Mach am besten auch einen Check mit eScan nach dieser Anleitung. Poste das Logfile.

Kathiii · 22.04.2006, 13:44

Ich habe gelöscht. Soll aber auch Malware Dateien löschen. Wo find ich die?
Und was ist SP? Wo krieg ich das her?

Danke für eure Mühen!

Bye Kathi

cosinus · 22.04.2006, 13:50

Das SP2 kannst Du hier downloaden.
Poste bitte das mit Hilfe der FIND.BAT "gefilterte" Logfile von eScan, siehe Anleitung.

Kathiii · 22.04.2006, 15:36

Hier der Log von E-San

Sat Apr 22 16:20:30 2006 => System found infected with searchexe Spyware/Adware ({002f4e27-b273-4fa5-adfc-1fb9ed210b37})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with minibug Adware ({2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with downloadware Spyware/Adware ({49de8655-4d15-4536-b67c-2aa6c1106740})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with brilliant digital variant Spyware ({51958169-d5e3-11d1-aa42-0000e842e40a})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.

Das SP habe ich noch nicht installiert. Danke schonmal. Der gesamte Log ist zu gross um ihn hier zu posten.

Bye Kathi

cosinus · 22.04.2006, 16:00

Du sollst auch nicht das gesamte Log hier reinstellen, sondern das "gefilterte". Lies die Anleitung bitte genau, ganz unten unter Punkt [5].

Kathiii · 22.04.2006, 16:48

Führe den 5 Schritt aus, erhalte aber kein Log. Es öffnet sich nur so ein Fenster. Muss ich den Scan nochmal wiederholen? Und dann find.bat machen?

Bye Kathi

cosinus · 22.04.2006, 16:51

Direkt auf Laufwerk C:\ solltest Du die Datei "escan_neu.txt" finden. Den Inhalt dieser Datei bitte posten.

Kathiii · 22.04.2006, 16:59

Hmmm,

habe die Progamme auf M: abgespeichert. Lasse die Datei "escan_neu.txt" suchen, aber er findet sie nicht. heul, und help.

Bye Kathi

Habe die Datei MWAV Textdokument 59 KB.

Bye Kathi

cosinus · 22.04.2006, 17:01

*seufz*
Hast Du wie in der Anleitung beschrieben, die heruntergeladene Datei nach C:\BASES_X entpackt? Ist die Sprache in eScan auf Englisch (sonst klappt das mit der FIND.BAT nicht)....

Kathiii · 22.04.2006, 17:39

Die Datei ist schon entpackt. soll ich sie in C:\BASES_X kopieren?

Help

Bye Kathi

Kathiii · 23.04.2006, 12:51

Hier ist der Log von E-Scan:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Apr 22 16:20:30 2006 => System found infected with searchexe Spyware/Adware ({002f4e27-b273-4fa5-adfc-1fb9ed210b37})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with minibug Adware ({2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with downloadware Spyware/Adware ({49de8655-4d15-4536-b67c-2aa6c1106740})! Action taken: No Action Taken.
Sat Apr 22 16:20:30 2006 => System found infected with brilliant digital variant Spyware ({51958169-d5e3-11d1-aa42-0000e842e40a})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sat Apr 22 16:20:31 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with downloadware Spyware/Adware ({a8f92c35-530b-4907-922c-ce31d4b6b14a})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with downloadware Spyware/Adware ({1eb48aa7-d3fe-4e4c-ac8e-b01594496ac0})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with downloadware Spyware/Adware ({42bd9965-303d-4cfb-aae0-dcadcb791a55})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with search-exe Spyware/Adware ({83a13e87-fa20-4b6a-aae8-c1226b5e1573})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with downloadware Spyware/Adware ({f5f0a448-2bcd-459e-8743-c39154ee1ca8})! Action taken: No Action Taken.
Sat Apr 22 16:21:26 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sat Apr 22 16:21:29 2006 => System found infected with bde Spyware/Adware (bdedownloader.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:30 2006 => System found infected with bde Spyware/Adware (bdefdi.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:30 2006 => System found infected with bde Spyware/Adware (bdedownloader.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:30 2006 => System found infected with bde Spyware/Adware (bdefdi.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:30 2006 => System found infected with cydoor Spyware/Adware (cd_clint.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:52 2006 => System found infected with smitfraud variant Browser Hijacker (car insurance.url)! Action taken: No Action Taken.
Sat Apr 22 16:21:52 2006 => System found infected with ezula Spyware/Adware (computers.url)! Action taken: No Action Taken.
Sat Apr 22 16:21:52 2006 => System found infected with smitfraud variant Browser Hijacker (mp3.url)! Action taken: No Action Taken.
Sat Apr 22 16:21:52 2006 => System found infected with smitfraud variant Browser Hijacker (mp3.url)! Action taken: No Action Taken.
Sat Apr 22 16:21:58 2006 => System found infected with cydoor Spyware/Adware (cd_clint.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:22 2006 => System found infected with searchexe Spyware/Adware ({002f4e27-b273-4fa5-adfc-1fb9ed210b37})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with minibug Adware ({2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({49de8655-4d15-4536-b67c-2aa6c1106740})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with brilliant digital variant Spyware ({51958169-d5e3-11d1-aa42-0000e842e40a})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({9368d063-44be-49b9-bd14-bb9663fd38fc})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({a8f92c35-530b-4907-922c-ce31d4b6b14a})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({1eb48aa7-d3fe-4e4c-ac8e-b01594496ac0})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({42bd9965-303d-4cfb-aae0-dcadcb791a55})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with search-exe Spyware/Adware ({83a13e87-fa20-4b6a-aae8-c1226b5e1573})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with downloadware Spyware/Adware ({f5f0a448-2bcd-459e-8743-c39154ee1ca8})! Action taken: No Action Taken.
Sun Apr 23 13:36:23 2006 => System found infected with alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Sun Apr 23 13:36:25 2006 => System found infected with bde Spyware/Adware (bdedownloader.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:25 2006 => System found infected with bde Spyware/Adware (bdefdi.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:26 2006 => System found infected with bde Spyware/Adware (bdedownloader.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:26 2006 => System found infected with bde Spyware/Adware (bdefdi.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:26 2006 => System found infected with cydoor Spyware/Adware (cd_clint.dll)! Action taken: No Action Taken.
Sun Apr 23 13:36:40 2006 => System found infected with smitfraud variant Browser Hijacker (car insurance.url)! Action taken: No Action Taken.
Sun Apr 23 13:36:40 2006 => System found infected with ezula Spyware/Adware (computers.url)! Action taken: No Action Taken.
Sun Apr 23 13:36:40 2006 => System found infected with smitfraud variant Browser Hijacker (mp3.url)! Action taken: No Action Taken.
Sun Apr 23 13:36:41 2006 => System found infected with smitfraud variant Browser Hijacker (mp3.url)! Action taken: No Action Taken.
Sun Apr 23 13:36:48 2006 => System found infected with cydoor Spyware/Adware (cd_clint.dll)! Action taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "cydoor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "midaddle Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "cydoor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:28 2006 => Object "delfin media viewer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:29 2006 => Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:29 2006 => Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:29 2006 => Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:29 2006 => Object "gator-gain-claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:30 2006 => Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sat Apr 22 16:21:54 2006 => Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "cydoor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "midaddle Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "cydoor Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "delfin media viewer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:24 2006 => Object "downloadware Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:25 2006 => Object "gator-gain-claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:26 2006 => Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Sun Apr 23 13:36:42 2006 => Object "casinoclient Spyware/Adware" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Sat Apr 22 16:21:29 2006 => Offending file found: C:\WINDOWS\TEMP\brilliant\bdedownloader.dll
Sat Apr 22 16:21:30 2006 => Offending file found: C:\WINDOWS\TEMP\brilliant\bdefdi.dll
Sat Apr 22 16:21:30 2006 => Offending file found: C:\WINDOWS\System32\bdedownloader.dll
Sat Apr 22 16:21:30 2006 => Offending file found: C:\WINDOWS\System32\bdefdi.dll
Sat Apr 22 16:21:30 2006 => Offending file found: C:\DOKUME~1\KATHAR~1\LOKALE~1\Temp\cd_clint.dll
Sat Apr 22 16:21:52 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-autos-\car insurance.url
Sat Apr 22 16:21:52 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-computers and internet-\computers.url
Sat Apr 22 16:21:52 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-entertainment-\mp3.url
Sat Apr 22 16:21:52 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-music-\mp3.url
Sat Apr 22 16:21:58 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Lokale Einstellungen\temp\cd_clint.dll
Sun Apr 23 13:36:25 2006 => Offending file found: C:\WINDOWS\TEMP\brilliant\bdedownloader.dll
Sun Apr 23 13:36:25 2006 => Offending file found: C:\WINDOWS\TEMP\brilliant\bdefdi.dll
Sun Apr 23 13:36:26 2006 => Offending file found: C:\WINDOWS\System32\bdedownloader.dll
Sun Apr 23 13:36:26 2006 => Offending file found: C:\WINDOWS\System32\bdefdi.dll
Sun Apr 23 13:36:26 2006 => Offending file found: C:\DOKUME~1\KATHAR~1\LOKALE~1\Temp\cd_clint.dll
Sun Apr 23 13:36:40 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-autos-\car insurance.url
Sun Apr 23 13:36:40 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-computers and internet-\computers.url
Sun Apr 23 13:36:40 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-entertainment-\mp3.url
Sun Apr 23 13:36:41 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Favoriten\-music-\mp3.url
Sun Apr 23 13:36:48 2006 => Offending file found: C:\Dokumente und Einstellungen\Kath\Lokale Einstellungen\temp\cd_clint.dll
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Sat Apr 22 16:21:29 2006 => Offending Folder found: C:\WINDOWS\TEMP\adware
Sat Apr 22 16:21:30 2006 => Offending Folder found: C:\Programme\se
Sat Apr 22 16:21:54 2006 => Offending Folder found: C:\Dokumente und Einstellungen\Kath\Eigene Dateien\ea games\die sims 2\music\cas
Sun Apr 23 13:36:25 2006 => Offending Folder found: C:\WINDOWS\TEMP\adware
Sun Apr 23 13:36:26 2006 => Offending Folder found: C:\Programme\se
Sun Apr 23 13:36:42 2006 => Offending Folder found: C:\Dokumente und Einstellungen\Kath\Eigene Dateien\ea games\die sims 2\music\cas
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Sat Apr 22 16:21:28 2006 => Offending Key found: HKLM\Software\cydoor !!!
Sat Apr 22 16:21:28 2006 => Offending Key found: HKLM\Software\kazaa !!!
Sat Apr 22 16:21:28 2006 => Offending Key found: HKLM\Software\search-exe !!!
Sat Apr 22 16:21:28 2006 => Offending Key found: HKLM\Software\whenu !!!
Sat Apr 22 16:21:28 2006 => Offending Key found: HKCU\Software\cydoor !!!
Sat Apr 22 16:21:28 2006 => Offending Key found: HKCU\Software\delfin !!!
Sat Apr 22 16:21:29 2006 => Offending Key found: HKCU\Software\kazaa !!!
Sat Apr 22 16:21:29 2006 => Offending Key found: HKCU\Software\medialoads !!!
Sat Apr 22 16:21:29 2006 => Offending Key found: HKCU\Software\webinstall !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKLM\Software\cydoor !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKLM\Software\kazaa !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKLM\Software\search-exe !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKLM\Software\whenu !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKCU\Software\cydoor !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKCU\Software\delfin !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKCU\Software\kazaa !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKCU\Software\medialoads !!!
Sun Apr 23 13:36:24 2006 => Offending Key found: HKCU\Software\webinstall !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sat Apr 22 16:24:02 2006 => Total Errors: 0
Sat Apr 22 16:24:02 2006 => Time Elapsed: 00:04:11
Sat Apr 22 16:24:02 2006 => Total Objects Scanned: 4888
Sat Apr 22 14:55:45 2006 => Virus Database Date: 4/17/2006
Sat Apr 22 16:19:05 2006 => Virus Database Date: 4/17/2006
Sat Apr 22 16:24:15 2006 => Virus Database Date: 4/17/2006
Sat Apr 22 18:37:00 2006 => Virus Database Date: 4/17/2006
Sun Apr 23 13:13:00 2006 => Virus Database Date: 4/17/2006
Sun Apr 23 13:14:20 2006 => Virus Database Date: 4/23/2006
Sun Apr 23 13:35:07 2006 => Virus Database Date: 4/17/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hoffe, dass ist jetzt der richtige Log.

Danke

Bye Kathi

cosinus · 23.04.2006, 15:24

Du hast da einiges an Spy- und Adware drauf! Lösch mal am besten alle temporären Dateien, auch die temp. Internetdateien. Die Ordner für die temporären Dateien sind:

Zitat:

C:\WINDOWS\TEMP
C:\DOKUMENTE UND EINSTELLUNGEN\***\LOKALE EINSTELLUNGEN\TEMP

Achte am besten vorher drauf, ob das Anzeigen aller Dateien aktiviert sind, schau also nach, ob in den Ordneroptionen unter Windows nach. Die geschützten Systemdateien und versteckten Dateien also anzeigen lassen, es könnte nämlich sein, dass sich so manche Adwaredatei vor Dir verstecken will

Die temp. Internetdateien kannst Du über den IE löschen unter Extras, Internetoptionen, Register "Allgemein", Dateien löschen.
Hast Du eigentlich schon das SP2 eingespielt?
Kazaa solltest Du nicht verwenden, diese Software ist vollgepumpt mit Ad- und Spyware. Also deinstallieren.
Folgende Dateien solltest Du m.E. auch löschen:

Zitat:

C:\WINDOWS\System32\bdedownloader.dll
C:\WINDOWS\System32\bdefdi.dll

Lass Dein System am besten auch nochmal mit Ewido aufräumen. Vor dem Scannen nat. erstmal die Signaturen updaten. Kannst ja dann mal posten, wieviel der noch gefunden und gelöscht hat.
Verwende nach Möglichkeit NICHT den Internet Explorer, sondern besser Browser wie Mozilla Firefox oder Opera.

22.04.2006, 13:50	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	$C:\Programme\...\SEINST.EXE Was tun? - Standard$ C:\Programme\...\SEINST.EXE Was tun? Das SP2 kannst Du hier downloaden. Poste bitte das mit Hilfe der FIND.BAT "gefilterte" Logfile von eScan, siehe Anleitung. __________________ --> C:\Programme\...\SEINST.EXE Was tun?

22.04.2006, 16:00	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	$C:\Programme\...\SEINST.EXE Was tun? - Standard$ C:\Programme\...\SEINST.EXE Was tun? Du sollst auch nicht das gesamte Log hier reinstellen, sondern das "gefilterte". Lies die Anleitung bitte genau, ganz unten unter Punkt [5]. __________________ Logfiles bitte immer in CODE-Tags posten

22.04.2006, 16:51	#10
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	$C:\Programme\...\SEINST.EXE Was tun? - Standard$ C:\Programme\...\SEINST.EXE Was tun? Direkt auf Laufwerk C:\ solltest Du die Datei "escan_neu.txt" finden. Den Inhalt dieser Datei bitte posten. __________________ Logfiles bitte immer in CODE-Tags posten

22.04.2006, 17:01	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	$C:\Programme\...\SEINST.EXE Was tun? - Standard$ C:\Programme\...\SEINST.EXE Was tun? seufz Hast Du wie in der Anleitung beschrieben, die heruntergeladene Datei nach C:\BASES_X entpackt? Ist die Sprache in eScan auf Englisch (sonst klappt das mit der FIND.BAT nicht).... __________________ Logfiles bitte immer in CODE-Tags posten

C:\Programme\...\SEINST.EXE Was tun?

Plagegeister aller Art und deren Bekämpfung: C:\Programme\...\SEINST.EXE Was tun?