| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Wie bekomme ich die S****e weg?!?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
20.04.2007, 17:38
| #1 |
 |  Wie bekomme ich die S****e weg?!? hallo ich hab durch einen von miener bekanten versendeten link im icq einen virus erhalten.... hab schon adeare und norman durchlaufen lassen ... beide bekommen des ding nicht runter ... antivier zeigt ihn mir an, aber kann ihn werder löschen, verschieben oder sonstirgendwas ... das ding nennt sich worm/stration.gen ich hoffe einer von euch kann mir weiterhelfen ich glaub ihr braucht diese hijackthis-logfile, hier habt ihr ... Logfile of HijackThis v1.99.1 Scan saved at 6:21:31 PM, on 4/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\HP_Administrator\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=PAVILION&pf=desktop R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DMAScheduler] "c:\Programme\HP DigitalMedia Archive\DMAScheduler.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RemoteControl] "C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [idl32.exe] C:\WINDOWS\idl32.exe s O4 - HKLM\..\Run: [himem.exe] C:\WINDOWS\skksd32.exe -s O4 - HKLM\..\Run: [SoundMnEx32] C:\WINDOWS\skksd32.exe O4 - HKLM\..\Run: [wincrt.exe] C:\WINDOWS\wincrt.exe s O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BitTorrent] "C:\Programme\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [Steam] C:\Programme\Valve\Steam\\Steam.exe -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab O20 - AppInit_DLLs: e1.dll O20 - Winlogon Notify: shfoxpob - C:\WINDOWS\system32\shfoxpob.dll O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe ihr könnt mir gern auch sagen wasda noch für viren drauf sind, sind bestimmt an ganz schöner haufen^^ |
|
20.04.2007, 18:47
| #2 | |
| Administrator > Competence Manager  |  Wie bekomme ich die S****e weg?!? Hallo und
__________________ im Trojaner Board!Dateien Online überprüfen lassen: * Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien: (lass auch die versteckten Dateien anzeigen!) Zitat:
* Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen. Gruß Sunny (Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!)
__________________ |
|
21.04.2007, 08:02
| #3 |
| | Wie bekomme ich die S****e weg?!? also .... hir hast du die files ... hört sich alles ziemlich schelcht an ... ich hoff mein pc ist noch zu retten
__________________C:\WINDOWS\idl32.exe STATUS: FINISHEDComplete scanning result of "idl32.exe", received in VirusTotal at 04.21.2007, 08:32:35 (CET). Antivirus Version Update Result AhnLab-V3 2007.4.21.0 04.20.2007 Win32/Stration.worm.177152 AntiVir 7.3.1.53 04.20.2007 Worm/Stration.HP Authentium 4.93.8 04.20.2007 W32/Warezov.gen2!W32DL Avast 4.7.981.0 04.20.2007 no virus found AVG 7.5.0.464 04.20.2007 I-Worm/Stration.CUZ BitDefender 7.2 04.21.2007 Win32.Warezov.XK CAT-QuickHeal 9.00 04.20.2007 no virus found ClamAV devel-20070416 04.20.2007 Worm.Stration.ACK DrWeb 4.33 04.20.2007 Win32.HLLM.Limar eSafe 7.0.15.0 04.19.2007 suspicious Trojan/Worm eTrust-Vet 30.7.3583 04.21.2007 no virus found Ewido 4.0 04.20.2007 Worm.Warezov.ne FileAdvisor 1 04.21.2007 No threat detected Fortinet 2.85.0.0 04.21.2007 PossibleThreat F-Prot 4.3.2.48 04.20.2007 W32/Warezov.gen2!W32DL F-Secure 6.70.13030.0 04.20.2007 no virus found Ikarus T3.1.1.5 04.21.2007 Email-Worm.Win32.Warezov Kaspersky 4.0.2.24 04.21.2007 no virus found McAfee 5014 04.20.2007 no virus found Microsoft 1.2405 04.21.2007 Trojan:Win32/Stration.gen!D NOD32v2 2208 04.21.2007 a variant of Win32/Stration.XK Norman 5.80.02 04.20.2007 no virus found Panda 9.0.0.4 04.20.2007 Trj/Downloader.NXS Prevx1 V2 04.21.2007 Malware:SysCovert Sophos 4.16.0 04.20.2007 no virus found Sunbelt 2.2.907.0 04.19.2007 no virus found Symantec 10 04.20.2007 no virus found TheHacker 6.1.6.095 04.15.2007 no virus found VBA32 3.11.4 04.20.2007 MalwareScope.Worm.Warezov.1 VirusBuster 4.3.7:9 04.20.2007 no virus found Webwasher-Gateway 6.0.1 04.21.2007 Worm.Stration.HP Aditional Information File size: 177152 bytes MD5: 008960d4469d051c730a185b976977ea SHA1: 9fa59771b2572fba644b771dee6410ff5ba6e5e3 packers: UPX packers: UPX Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=008960d4469d051c730a185b976977ea packers: UPX Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=5d0289465697 VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. > Go to: Home Contactar En Español -------------------------------------------------------------------------------- www.virustotal.com :: ©Hispasec Sistemas 2004-07:: e-mail info@virustotal.com C:\WINDOWS\wincrt.exe STATUS: FINISHEDComplete scanning result of "wincrt.exe", received in VirusTotal at 04.21.2007, 08:38:35 (CET). Antivirus Version Update Result AhnLab-V3 2007.4.21.0 04.20.2007 Dropper/Stration.179200 AntiVir 7.3.1.53 04.20.2007 Worm/Stration.HP Authentium 4.93.8 04.20.2007 W32/Warezov.gen2!W32DL Avast 4.7.981.0 04.20.2007 no virus found AVG 7.5.0.464 04.20.2007 no virus found BitDefender 7.2 04.21.2007 no virus found CAT-QuickHeal 9.00 04.20.2007 no virus found ClamAV devel-20070416 04.20.2007 Worm.Stration.ACQ DrWeb 4.33 04.20.2007 no virus found eSafe 7.0.15.0 04.19.2007 suspicious Trojan/Worm eTrust-Vet 30.7.3583 04.21.2007 no virus found Ewido 4.0 04.20.2007 no virus found FileAdvisor 1 04.21.2007 no virus found Fortinet 2.85.0.0 04.21.2007 PossibleThreat F-Prot 4.3.2.48 04.20.2007 W32/Warezov.gen2!W32DL F-Secure 6.70.13030.0 04.20.2007 Email-Worm.Win32.Warezov.cu Ikarus T3.1.1.5 04.21.2007 Email-Worm.Win32.Warezov Kaspersky 4.0.2.24 04.21.2007 Email-Worm.Win32.Warezov.cu McAfee 5014 04.20.2007 no virus found Microsoft 1.2405 04.21.2007 Trojan:Win32/Stration.gen!D NOD32v2 2208 04.21.2007 a variant of Win32/Stration.XK Norman 5.80.02 04.20.2007 no virus found Panda 9.0.0.4 04.20.2007 no virus found Prevx1 V2 04.21.2007 Covert.Sys.Exec Sophos 4.16.0 04.20.2007 no virus found Sunbelt 2.2.907.0 04.19.2007 no virus found Symantec 10 04.20.2007 no virus found TheHacker 6.1.6.088 04.09.2007 no virus found VBA32 3.11.4 04.20.2007 MalwareScope.Worm.Warezov.1 VirusBuster 4.3.7:9 04.20.2007 no virus found Webwasher-Gateway 6.0.1 04.21.2007 Worm.Stration.HP Aditional Information File size: 179200 bytes MD5: 2f1f710f2caad97e7d85d064931bd2e7 SHA1: 60fb22379be0fb5acff5725e6992d53841f2c33e packers: UPX packers: UPX packers: UPX Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=720890325492 VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. > Go to: Home Contactar En Español -------------------------------------------------------------------------------- www.virustotal.com :: ©Hispasec Sistemas 2004-07:: e-mail info@virustotal.com C:\WINDOWS\system32\shfoxpob.dll STATUS: FINISHEDComplete scanning result of "shfoxpob.dll_", received in VirusTotal at 04.21.2007, 08:46:51 (CET). Antivirus Version Update Result AhnLab-V3 2007.4.21.0 04.20.2007 Win32/Stration.worm.Gen AntiVir 7.3.1.53 04.20.2007 WORM/Stration.Gen Authentium 4.93.8 04.20.2007 W32/Warezov.gen4 Avast 4.7.981.0 04.20.2007 Win32:Warezov-BVC AVG 7.5.0.464 04.20.2007 no virus found BitDefender 7.2 04.21.2007 Win32.Warezov.XJ@mm CAT-QuickHeal 9.00 04.20.2007 no virus found ClamAV devel-20070416 04.20.2007 Worm.Stration.ACJ-4 DrWeb 4.33 04.20.2007 Win32.HLLM.Limar eSafe 7.0.15.0 04.19.2007 Win32.Warezov.nd eTrust-Vet 30.7.3583 04.21.2007 Win32/Stration!generic Ewido 4.0 04.20.2007 Worm.Warezov.nd FileAdvisor 1 04.21.2007 High threat detected Fortinet 2.85.0.0 04.21.2007 W32/Stration.ND@mm F-Prot 4.3.2.48 04.20.2007 W32/Warezov.gen4 F-Secure 6.70.13030.0 04.20.2007 Email-Worm.Win32.Warezov.nd Ikarus T3.1.1.5 04.21.2007 Email-Worm.Win32.Warezov.nd Kaspersky 4.0.2.24 04.21.2007 Email-Worm.Win32.Warezov.nd McAfee 5014 04.20.2007 W32/Stration.gen@MM Microsoft 1.2405 04.21.2007 Trojan:Win32/Stration.F!dll NOD32v2 2208 04.21.2007 Win32/Stration.YQ Norman 5.80.02 04.20.2007 no virus found Panda 9.0.0.4 04.20.2007 W32/Spamta.WA.worm Prevx1 V2 04.21.2007 no virus found Sophos 4.16.0 04.20.2007 no virus found Sunbelt 2.2.907.0 04.19.2007 no virus found Symantec 10 04.20.2007 W32.Stration@mm TheHacker 6.1.6.088 04.09.2007 no virus found VBA32 3.11.4 04.20.2007 MalwareScope.Worm.Warezov.6 VirusBuster 4.3.7:9 04.20.2007 no virus found Webwasher-Gateway 6.0.1 04.21.2007 Worm.Stration.Gen Aditional Information File size: 98304 bytes MD5: dd171df255413e8126c762cf5531d10f SHA1: f8ff4f0f352964dc67640dd0b18a1e1b2d6e5fa0 Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=dd171df255413e8126c762cf5531d10f VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware. > Go to: Home Contactar En Español -------------------------------------------------------------------------------- www.virustotal.com :: ©Hispasec Sistemas 2004-07:: e-mail info@virustotal.com das vierte file C:\WINDOWS\skksd32.exe lässt sich leider nicht mehr auffienden |
|
21.04.2007, 09:15
| #4 | ||
| Administrator > Competence Manager | Wie bekomme ich die S****e weg?!? Anleitung KILLBOX Lade dir mal die Killbox, starte das Programm, klicke auf die Option -> delete on reboot und suche nun folgende Datei: (oder kopiere den Dateipfad!) Zitat:
Suche nun noch diese: Zitat:
Starte das System neu uns poste ein neues Hijacklog! Arbeiten mit MWAV (eScan) * Lies dir folgende Anleitung genau durch und arbeite sie ab: -> Anleitung eScan * Wichtig: Poste im Anschluss das Ergebnis mit Hilfe der “find.bat”. (steht alles ganz genau in der Anleitung.) Gruß Sunny
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
21.04.2007, 15:30
| #5 |
| | Wie bekomme ich die S****e weg?!? hier ist einmal des hijackthis-file Logfile of HijackThis v1.99.1 Scan saved at 4:29:30 PM, on 4/21/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\HP_Administrator\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=PAVILION&pf=desktop R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DMAScheduler] "c:\Programme\HP DigitalMedia Archive\DMAScheduler.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RemoteControl] "C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [idl32.exe] C:\WINDOWS\idl32.exe s O4 - HKLM\..\Run: [himem.exe] C:\WINDOWS\skksd32.exe -s O4 - HKLM\..\Run: [SoundMnEx32] C:\WINDOWS\skksd32.exe O4 - HKLM\..\Run: [wincrt.exe] C:\WINDOWS\wincrt.exe s O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BitTorrent] "C:\Programme\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [Steam] C:\Programme\Valve\Steam\\Steam.exe -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab O20 - AppInit_DLLs: e1.dll trafracp.dll O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe |
|
21.04.2007, 15:31
| #6 |
| | Wie bekomme ich die S****e weg?!? und hier des escan-file ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Header ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ find.bat Version 2007.04.20.01 Installationssprache Englisch find.bat im normalen Modus ausgefuehrt Microsoft Windows XP [Version 5.1.2600] Version REG_SZ 9.1.9 Sat Apr 21 11:43:15 2007 => Virus Database Date: 4/20/2007 Sat Apr 21 12:17:06 2007 => Virus Database Date: 4/20/2007 Sat Apr 21 12:17:55 2007 => Virus Database Date: 4/20/2007 Sat Apr 21 14:14:04 2007 => Virus Database Date: 4/20/2007 Sat Apr 21 16:04:15 2007 => Virus Database Date: 4/20/2007 Sat Apr 21 16:11:53 2007 => Virus Database Date: 4/20/2007 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Infektionsmeldungen ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sat Apr 21 11:51:56 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken. Sat Apr 21 11:52:01 2007 => System found infected with whenu.savenow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken. Sat Apr 21 11:52:19 2007 => System found infected with whenu.savenow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken. Sat Apr 21 11:52:20 2007 => System found infected with smitfraud Browser Hijacker (ot.ico)! Action taken: No Action Taken. Sat Apr 21 11:52:20 2007 => System found infected with smitfraud Browser Hijacker (ts.ico)! Action taken: No Action Taken. Sat Apr 21 14:23:36 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken. Sat Apr 21 14:23:41 2007 => System found infected with whenu.savenow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken. Sat Apr 21 14:24:04 2007 => System found infected with whenu.savenow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken. Sat Apr 21 14:24:05 2007 => System found infected with smitfraud Browser Hijacker (ot.ico)! Action taken: No Action Taken. Sat Apr 21 14:24:05 2007 => System found infected with smitfraud Browser Hijacker (ts.ico)! Action taken: No Action Taken. Sat Apr 21 11:51:58 2007 => Object "video activex object Trojan" found in File System! Action Taken: No Action Taken. Sat Apr 21 11:51:58 2007 => Object "virusburst Trojan" found in File System! Action Taken: No Action Taken. Sat Apr 21 11:51:58 2007 => Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Apr 21 11:51:58 2007 => Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Apr 21 11:52:31 2007 => Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken. Sat Apr 21 14:23:37 2007 => Object "video activex object Trojan" found in File System! Action Taken: No Action Taken. Sat Apr 21 14:23:37 2007 => Object "virusburst Trojan" found in File System! Action Taken: No Action Taken. Sat Apr 21 14:23:37 2007 => Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Apr 21 14:23:39 2007 => Object "grokster Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Apr 21 14:24:17 2007 => Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken. ~~~~~~~~~~~ Dateien ~~~~~~~~~~~ ~~~~ Infected files ~~~~~~~~~~~ Sat Apr 21 11:46:46 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 11:46:46 2007 => File C:\WINDOWS\system32\trafracp.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:47:01 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 11:53:15 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 11:53:38 2007 => File C:\WINDOWS\system32\msstersv.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:54:02 2007 => File C:\WINDOWS\system32\secumsje.exe infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:54:03 2007 => File C:\WINDOWS\system32\shfoxpob.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:54:09 2007 => File C:\WINDOWS\system32\trafracp.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:57:53 2007 => File C:\!KillBox\shfoxpob.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:35 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\0A66435F.tmp//CryptFF infected by "Trojan.Java.ClassLoader.h" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:35 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\151C08C3.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:35 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152606B8.dll//CryptFF//PE_Patch infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152606B8.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bps" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152C5AB1.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\284D0F82.cla//CryptFF infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\4B63772F.tmp//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\58235CAF.dll//CryptFF//PE_Patch infected by "Trojan-Downloader.Win32.Zlob.bnw" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\5D452B0E.tmp//CryptFF infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B236E31.tmp//CryptFF infected by "Trojan.Java.ClassLoader.ao" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B26182E.tmp//CryptFF infected by "Trojan.Java.ClassLoader.ao" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B4A06CF.tmp//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6E986064.htm//CryptFF infected by "Trojan-Downloader.JS.Agent.eg" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\70BE46E2.cla//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\70C170DF.cla//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\74C86B95.htm//CryptFF infected by "Trojan-Downloader.JS.Agent.bi" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\75035F54.htm//CryptFF infected by "Trojan-Downloader.JS.Psyme.dy" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\75C57688.cla//CryptFF infected by "Trojan.Java.ClassLoader.h" Virus! Action Taken: No Action Taken. Sat Apr 21 11:59:36 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\7D200EF9.wmf//CryptFF infected by "Trojan-Downloader.Win32.Agent.acd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:18:32 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 14:18:32 2007 => File C:\WINDOWS\system32\trafracp.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:18:40 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 14:24:57 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 14:25:17 2007 => File C:\WINDOWS\system32\msstersv.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:25:35 2007 => File C:\WINDOWS\system32\secumsje.exe infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:25:36 2007 => File C:\WINDOWS\system32\shfoxpob.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:25:39 2007 => File C:\WINDOWS\system32\trafracp.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:28:45 2007 => File C:\!KillBox\shfoxpob.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:47 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\0A66435F.tmp//CryptFF infected by "Trojan.Java.ClassLoader.h" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:47 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\151C08C3.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:47 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152606B8.dll//CryptFF//PE_Patch infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:47 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152606B8.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bps" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:47 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\152C5AB1.exe//CryptFF infected by "Trojan-Downloader.Win32.Zlob.bfh" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\284D0F82.cla//CryptFF infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\4B63772F.tmp//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\58235CAF.dll//CryptFF//PE_Patch infected by "Trojan-Downloader.Win32.Zlob.bnw" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\5D452B0E.tmp//CryptFF infected by "Trojan.Java.ClassLoader.d" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B236E31.tmp//CryptFF infected by "Trojan.Java.ClassLoader.ao" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B26182E.tmp//CryptFF infected by "Trojan.Java.ClassLoader.ao" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6B4A06CF.tmp//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\6E986064.htm//CryptFF infected by "Trojan-Downloader.JS.Agent.eg" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\70BE46E2.cla//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\70C170DF.cla//CryptFF infected by "Trojan-Downloader.Java.OpenConnection.aj" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\74C86B95.htm//CryptFF infected by "Trojan-Downloader.JS.Agent.bi" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\75035F54.htm//CryptFF infected by "Trojan-Downloader.JS.Psyme.dy" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\75C57688.cla//CryptFF infected by "Trojan.Java.ClassLoader.h" Virus! Action Taken: No Action Taken. Sat Apr 21 14:30:48 2007 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine\7D200EF9.wmf//CryptFF infected by "Trojan-Downloader.Win32.Agent.acd" Virus! Action Taken: No Action Taken. Sat Apr 21 15:41:35 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken. Sat Apr 21 15:41:53 2007 => File C:\WINDOWS\system32\msstersv.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 15:42:17 2007 => File C:\WINDOWS\system32\secumsje.exe infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 15:42:18 2007 => File C:\WINDOWS\system32\shfoxpob.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 15:42:31 2007 => File C:\WINDOWS\system32\trafracp.dll infected by "Email-Worm.Win32.Warezov.nd" Virus! Action Taken: No Action Taken. Sat Apr 21 16:04:15 2007 => File D:\AUTORUN.INF infected by "Fujack" Virus! Action Taken: No Action Taken. ~~~~~~~~~~~ ~~~~ Tagged files ~~~~~~~~~~~ ~~~~~~~~~~~ ~~~~ Offending files ~~~~~~~~~~~ Sat Apr 21 11:52:01 2007 => Offending file found: C:\DOKUME~1\HP_ADM~1\LOKALE~1\Temp\cmdlineext02.dll Sat Apr 21 11:52:19 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\cmdlineext02.dll Sat Apr 21 11:52:20 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\temp.fraae0\ot.ico Sat Apr 21 11:52:20 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\temp.fraae0\ts.ico Sat Apr 21 14:23:41 2007 => Offending file found: C:\DOKUME~1\HP_ADM~1\LOKALE~1\Temp\cmdlineext02.dll Sat Apr 21 14:24:04 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\cmdlineext02.dll Sat Apr 21 14:24:05 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\temp.fraae0\ot.ico Sat Apr 21 14:24:05 2007 => Offending file found: C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\temp\temp.fraae0\ts.ico ~~~~~~~~~~~ Ordner ~~~~~~~~~~~ ~~~~~~~~~~~ Registry ~~~~~~~~~~~ Sat Apr 21 11:51:58 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\video activex object !!! Sat Apr 21 11:51:58 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\virusburster !!! Sat Apr 21 11:51:58 2007 => Offending Key found: HKLM\Software\magnet !!! Sat Apr 21 11:51:58 2007 => Offending Key found: HKCU\\magnet !!! Sat Apr 21 11:52:31 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!! Sat Apr 21 14:23:37 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\video activex object !!! Sat Apr 21 14:23:37 2007 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\virusburster !!! Sat Apr 21 14:23:37 2007 => Offending Key found: HKLM\Software\magnet !!! Sat Apr 21 14:23:39 2007 => Offending Key found: HKCU\\magnet !!! Sat Apr 21 14:24:17 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Diverses ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~ Prozesse und Module ~~~~~~~~~~~~~~~~~~~~~~ Sat Apr 21 11:52:31 2007 => Executable Command Found in D\Shell\AutoRun\command: C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 Sat Apr 21 14:24:17 2007 => Executable Command Found in D\Shell\AutoRun\command: C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 Sat Apr 21 11:47:02 2007 => Invalid Entry DllName = C:\WINDOWS\system32\shfoxpob.dll (in key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\shfoxpob). Deleting Registry Key shfoxpob... ~~~~~~~~~~~~~~~~~~~~~~ Scanfehler ~~~~~~~~~~~~~~~~~~~~~~ Sat Apr 21 12:06:18 2007 => Result: ERROR!!! File C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla\Profiles\default\Cache\EC02C50Fd01: Scanning Failure!!! Sat Apr 21 14:37:25 2007 => Result: ERROR!!! File C:\Dokumente und Einstellungen\HP_Administrator\Lokale Einstellungen\Anwendungsdaten\Mozilla\Profiles\default\Cache\EC02C50Fd01: Scanning Failure!!! Sat Apr 21 14:58:26 2007 => Result: ERROR!!! File C:\Programme\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask: Scanning Failure!!! ~~~~~~~~~~~~~~~~~~~~~~ Hosts-Datei ~~~~~~~~~~~~~~~~~~~~~~ DataBasePath REG_EXPAND_SZ %SystemRoot%\System32\drivers\etc C:\WINDOWS\I386\HOSTS: C:\WINDOWS\system32\drivers\etc\hosts: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sat Apr 21 12:17:06 2007 => Total Critical Objects: 38 Sat Apr 21 16:04:15 2007 => Total Critical Objects: 43 Sat Apr 21 12:17:06 2007 => Total Disinfected Objects: 0 Sat Apr 21 16:04:15 2007 => Total Disinfected Objects: 0 Sat Apr 21 12:17:06 2007 => Total Objects Renamed: 0 Sat Apr 21 16:04:15 2007 => Total Objects Renamed: 0 Sat Apr 21 12:17:06 2007 => Total Deleted Objects: 0 Sat Apr 21 16:04:15 2007 => Total Deleted Objects: 0 Sat Apr 21 12:17:06 2007 => Total Errors: 109 Sat Apr 21 16:04:15 2007 => Total Errors: 112 Sat Apr 21 12:17:06 2007 => Time Elapsed: 00:30:13 Sat Apr 21 16:04:15 2007 => Time Elapsed: 01:45:41 Sat Apr 21 12:17:06 2007 => Total Objects Scanned: 58091 Sat Apr 21 16:04:15 2007 => Total Objects Scanned: 127539 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan-Optionen ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sat Apr 21 11:46:44 2007 => Memory Check: Enabled Sat Apr 21 14:18:31 2007 => Memory Check: Enabled Sat Apr 21 11:46:44 2007 => Registry Check: Enabled Sat Apr 21 14:18:31 2007 => Registry Check: Enabled Sat Apr 21 11:46:44 2007 => System Folder Check: Enabled Sat Apr 21 14:18:31 2007 => System Folder Check: Enabled Sat Apr 21 11:46:44 2007 => System Area Check: Disabled Sat Apr 21 14:18:31 2007 => System Area Check: Disabled Sat Apr 21 11:46:44 2007 => Services Check: Enabled Sat Apr 21 14:18:31 2007 => Services Check: Enabled Sat Apr 21 11:46:44 2007 => Drive Check: Disabled Sat Apr 21 11:46:44 2007 => All Drive Check :Enabled Sat Apr 21 14:18:31 2007 => Drive Check: Disabled Sat Apr 21 14:18:31 2007 => All Drive Check :Enabled Sat Apr 21 11:46:44 2007 => All Drive Check :Enabled Sat Apr 21 14:18:31 2007 => All Drive Check :Enabled |
|
21.04.2007, 15:36
| #7 |
| Administrator > Competence Manager | Wie bekomme ich die S****e weg?!? Gab es denn irgendwelche Fehlermeldungen von Killbox? Denn die Dateien sind immer noch vorhanden im Hijacklog! Poste aber erstmal noch die Auswertung von eScan. Sunny
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
21.04.2007, 15:52
| #8 |
| | Wie bekomme ich die S****e weg?!? also die killbox hat mir keien fehlermeldunegn gebracht ... aber ich kanns sie ja nochmal killen ... doppelt hält besser und des escanfile ist doch da ... oder hab ich da was falsch gemacht? |
|
21.04.2007, 15:59
| #9 |
| | Wie bekomme ich die S****e weg?!? jetzt hat mir die killbox ne fehlermeldung gegeben PendingFileRenameOperations Regestry Data has been Removed by External Proces ... aber des heißt ja soviel wie das sie schon weg sind, oder täusch ich mich? |
|
21.04.2007, 16:13
| #10 | |
| Administrator > Competence Manager | Wie bekomme ich die S****e weg?!? 1.) Leere den Quarantäne-Ordner von Antivir und den von Killbox! (C:\!KillBox und hier -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec\Norton AntiVirus\Quarantine ) 2.) Anleitung Avenger: 1.) Lade dir das Tool Avenger und speichere es auf dem Desktop:  2.) Klicke nun auf die Option „Input Script manually“ -> klicke jetzt auf die Lupe und kopiere folgenden Text rein: Zitat:
 4.) Danach das System unverzüglich neu starten lassen 5.) Lass HijackThis nochmal laufen, erstelle und poste ein neues HijackThis Logfile. Poste ausserdem den Inhalt der C:\avenger.txt Datei. Ad-Aware: Ad-Aware 1.06 herunterladen und damit das System bereinigen! Gruß Sunny
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
21.04.2007, 16:35
| #11 |
| | Wie bekomme ich die S****e weg?!? da hab ich auch schon des nächste problem avenger bringt mir ne fehlermeldung ////////////////////////////////////////// Avenger Pre-Processor log ////////////////////////////////////////// Fatal error: could not create new script file. Error code: 1813 Error logged to errorlog.txt. Aborting now! was kann ich dadagegen machen? |
|
21.04.2007, 16:40
| #12 | ||
| Administrator > Competence Manager | Wie bekomme ich die S****e weg?!? Dann halt hiermit: Anleitung KILLBOX Lade dir mal die Killbox, starte das Programm, klicke auf die Option -> delete on reboot und suche nun folgende Datei: (oder kopiere den Dateipfad!) Zitat:
Suche nun noch diese: Zitat:
Starte das System neu uns poste ein neues Hijacklog!
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
21.04.2007, 17:07
| #13 |
| | Wie bekomme ich die S****e weg?!? hier nochmal das logfile von hijackthis Logfile of HijackThis v1.99.1 Scan saved at 6:04:14 PM, on 4/21/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\HP DigitalMedia Archive\DMAScheduler.exe C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe C:\Programme\HP\HP Software Update\HPWuSchd2.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\ICQLite\ICQLite.exe C:\WINDOWS\system32\RunDLL32.exe C:\Programme\DAEMON Tools\daemon.exe C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Programme\Winamp\winampa.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\arservice.exe C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Programme\WinZip\WZQKPICK.EXE C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wuauclt.exe C:\Dokumente und Einstellungen\HP_Administrator\Desktop\HijackThis.exe C:\WINDOWS\system32\wuauclt.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=PAVILION&pf=desktop R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DMAScheduler] "c:\Programme\HP DigitalMedia Archive\DMAScheduler.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HPBootOp] "C:\Programme\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RemoteControl] "C:\Programme\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [idl32.exe] C:\WINDOWS\idl32.exe s O4 - HKLM\..\Run: [himem.exe] C:\WINDOWS\skksd32.exe -s O4 - HKLM\..\Run: [SoundMnEx32] C:\WINDOWS\skksd32.exe O4 - HKLM\..\Run: [wincrt.exe] C:\WINDOWS\wincrt.exe s O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BitTorrent] "C:\Programme\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\Run: [Steam] C:\Programme\Valve\Steam\\Steam.exe -silent O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Hilfe zu Verbindungen - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://arcade.icq.com/carlo/zuma/popcaploader_v5.cab O20 - AppInit_DLLs: e1.dll trafracp.dll O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Automatisches LiveUpdate - Scheduler - Symantec Corporation - C:\Programme\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe ich glaub ich bin geheilt ?!? |
|
21.04.2007, 17:16
| #14 |
| Administrator > Competence Manager | Wie bekomme ich die S****e weg?!? Man, der ist aber hartnäckig!  -dekativiere deinen Antiviren-Scanner. -lade dieses Tool -> Stration-Remover -danach das System neu starten! dann folgendes tun: -lade dir dieses Tool -> Counterspy V2 -danach starten und updaten nicht SCANNEN -Boote danach in den abgesicherten Modus -dann Counterspy starten -> Klicke: "Run a Spyware Scan Now" -Remove auswählen und dann neustarten! -suche das Log von Counterspy und poste es hier Dann nochmal ein neues Hijacklog erstellen! Hoffe das es diesmal klappt. 
__________________ Anfragen per Email, Profil- oder privater Nachricht werden ignoriert! Hilfe gibts NUR im Forum! Stulti est se ipsum sapientem putare. |
|
21.04.2007, 19:09
| #15 |
| | Wie bekomme ich die S****e weg?!? ne .. lass mal gut sein! mein antivir gibt kein alrm mehr! ... mehr wollte ich eigentlich garnicht^^ ich glaub des passt schon so wirs jetzt ist, funtktioniert alles wieder wunderbar... und die paar virusrestchen die können sich uaf mienem rehcenr ruhig austoben ... ich bin tierlieb ... und viren sind ja acuh eine art von tierchen also ... aufjeden fall en dickes merci für diene mühe bekommst dafür ein   mfg maagoo |
|
| Themen zu Wie bekomme ich die S****e weg?!? |
| administrator, adobe, antivir, appinit_dlls, avg, avgnt, avgnt.exe, avira, bho, ctfmon.exe, cyberlink, desktop, einstellungen, explorer, google, hijack, internet, internet explorer, norman, nvidia, object, rundll, software, solution, symantec, system, torrent.exe, urlsearchhook, viren, virus, windows, windows xp |
Linear-Darstellung
