| |
| |||||||
Log-Analyse und Auswertung: W32.Trojan.Startpage.is ProblemWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.08.2004, 10:15
| #24 |
 |  W32.Trojan.Startpage.is Problem So hallo, da bin ich wieder und habe haufenweise logs mitgebracht. Erstmal der escan log: File C:\WINDOWS\System32\nethv32.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.d. No Action Taken. File C:\WINDOWS\system32\nethv32.dll tagged as not-a-virus:RiskWare.Dialer.E-Group.d. No Action Taken. Dann den hijckthis log: Logfile of HijackThis v1.98.2 Scan saved at 09:52:16, on 12.08.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe C:\Dokumente und Einstellungen\chef 1\Eigene Dateien\Virus-Zeug\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Nokia Tray Application] C:\Programme\Gemeinsame Dateien\Nokia\Tools\NclTray.exe O4 - HKLM\..\Run: [KEN Taskbar Service] "C:\Programme\KEN!\kentbsrv.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\F-Secure\TNB\TNBUtil.exe" /CHECKALL O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [PPMemCheck] C:\Programme\PestPatrol\PPMemCheck.exe O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programme\PestPatrol\PPControl.exe O4 - HKLM\..\Run: [CookiePatrol] C:\Programme\PestPatrol\CookiePatrol.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - Global Startup: FRITZ!fax.lnk = C:\Programme\FRITZ!\FriFax32.exe O14 - IERESET.INF: START_PAGE_URL=http://192.168.0.12:3128/ken2000.html O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = FIRMA.local O17 - HKLM\Software\..\Telephony: DomainName = FIRMA.local O17 - HKLM\System\CCS\Services\Tcpip\..\{C74D3FEA-54CF-4CF6-BD7A-D8FC0402A920}: NameServer = 192.168.0.1,127.0.0.1 O17 - HKLM\System\CCS\Services\Tcpip\..\{DBDD636B-9621-438E-8BBA-A0457005001F}: NameServer = 192.168.114.254 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = FIRMA.local Wobei ich diesen: R3 - Default URLSearchHook is missing log nach dem scan gefixed habe. Und nun der FindnFix log: Teil1 Thu 12 Aug 04 10:37:02 »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»» *System: Microsoft Windows XP Professional 5.1 Service Pack 1 (Build 2600) *IE version: 6.0.2800.1106 SP1-Q832894-Q831167-Q837009-Q823353-Q867801 __________________________________ !!*Creating backups...!! The operation completed successfully __________________________________ *Local time: Donnerstag, 12. August 2004 (12.08.2004) 10:37, Westeuropäische Sommerzeit *Uptime: 10:37:04 up 0 days, 0:01:06 ---------------------------------------------------- »»Member of...: ("ADMIN" logon + group match required!) User is a member of group CHEF1\Kein. User is a member of group \Jeder. User is a member of group VORDEFINIERT\Administratoren. User is a member of group VORDEFINIERT\Benutzer. User is a member of group \LOKAL. User is a member of group NT-AUTORITÄT\INTERAKTIV. User is a member of group NT-AUTORITÄT\Authentifizierte Benutzer. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User: [CHEF1\Administrator], is a member of: VORDEFINIERT\Administratoren \Everyone »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»» The list will produce a small database of files that will match certain criteria. Ex: read only files, s/h files, last modified date. size, etc. The filters provided and registry scan should match the corresponding file(s) listed. »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Unless the file match the entire criteria, it should not be pointed to remove without attempting to confirm it's nature! »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» At times there could be several (legit) files flagged, and/or duplicate culprit file(s)! If in doubt, always search the file(s) and properties according to criteria! The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder »»»»»»»»»»»»»»»»»»***LOG!***(*updated 8/11)»»»»»»»»»»»»»»»» »»»*»»»*Use at your own risk!»»»*»»»* Scanning for file(s)... »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»» (*1*) »»»»» ......... »»Locked or 'Suspect' file(s) found... C:\WINDOWS\SYSTEM32\D3D.DLL +++ File read error \\?\C:\WINDOWS\System32\D3D.DLL +++ File read error »»»»» (*2*) »»»»»........ D3D.DLL Can't Open! DSOUND3D.DLL Can't Open! »»»»» (*3*) »»»»»........ No matches found. unknown/hidden files... No matches found. »»»»» (*4*) »»»»»......... Sniffing.......... Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»»»(*5*)»»»»» ¯ Access denied ® ..................... D3D.DLL .....57344 07.07.2004 ¯ Access denied ® ..................... DSOUND3D.DLL ...1293824 18.08.2001 »»»»»(*6*)»»»»» fgrep: can't open input C:\WINDOWS\SYSTEM32\D3D.DLL fgrep: can't open input C:\WINDOWS\SYSTEM32\DSOUND3D.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» »»»»»Search by size... C:\WINDOWS\SYSTEM32\ d3d.dll Wed 7 Jul 2004 13:59:06 ..... 57.344 56,00 K 1 item found: 1 file, 0 directories. Total of file sizes: 57.344 bytes 56,00 K No matches found. No matches found. Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. Sniffed -> C:\WINDOWS\SYSTEM32\D3D.DLL SNiF 1.34 statistics Matching files : 1 Amount in bytes : 57344 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15. SNiF 1.34 statistics Matching files : 0 Amount in bytes : 0 Directories searched : 1 Commands executed : 0 Masks sniffed for: *.DLL »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»» |
| Themen zu W32.Trojan.Startpage.is Problem |
| .html, .inf, adobe, antivirus, antivirus scan, application, askbar, bho, browser, dateien, drivers, einstellungen, ellung, explorer, f-secure, file missing, fritz!, google, hijack, hijackthis, hilfe, internet, internet explorer, langsam, microsoft, namen, neue, nvcpl.dll, ordner, problem, programme, rundll, schutz, software, symantec, tcpip, träge, virus/trojaner, windows xp |
Baum-Darstellung