Ja, habe schon wieder so einiges an Trojaner auf meinem Rechner und bitte nochmals um Hilfe *verzweifeltfrag*

Danach leg ich mir auf jeden Fall nen neuen guten Virusscanner zu!

____________________________________
e scan:


Sat Sep 11 12:38:24 2004 => ***** Scanning complete. *****

Sat Sep 11 12:38:24 2004 => Total Number of Files Scanned: 59671
Sat Sep 11 12:38:24 2004 => Total Number of Virus(es) Found: 49
Sat Sep 11 12:38:24 2004 => Total Number of Disinfected Files: 0
Sat Sep 11 12:38:24 2004 => Total Number of Files Renamed: 8
Sat Sep 11 12:38:24 2004 => Total Number of Deleted Files: 25
Sat Sep 11 12:38:24 2004 => Total Number of Errors: 17
Sat Sep 11 12:38:24 2004 => Time Elapsed: 00:20:14
Sat Sep 11 12:38:24 2004 => Virus Database Date: 2004/09/07
Sat Sep 11 12:38:24 2004 => Virus Database Count: 103388

Sat Sep 11 12:38:24 2004 => Scan Completed.

_______________________________

hijack this:

Logfile of HijackThis v1.98.2
Scan saved at 13:50:30, on 11.09.2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE
C:\WINDOWS\SYSTEM\E_S10IC2.EXE
C:\PROGRAMME\MAUS\POINT32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAMME\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\TSMSVC.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
D:\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM219.DLL (file missing)
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\TWAINTEC.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE"
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\SYSTEM\stcloader.exe
O4 - HKLM\..\Run: [ClrSchLoader] \Progra~1\ClearSearch\Loader.exe
O4 - HKLM\..\Run: [VBouncerDL] C:\Programme\VBouncer\VBouncerInner.exe /S
O4 - HKLM\..\Run: [haggreep] C:\WINDOWS\SYSTEM\wnzdur.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - Startup: Verknüpfung mit point32.lnk = C:\Programme\Maus\point32.exe
O4 - Startup: Watchdog.lnk = C:\WINDOWS\TWAIN\A4s2\Watchdog.exe
O4 - Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office.lnk = C:\Programme\Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL

______________________________
Antivir hat auch einiges gefunden gehabt, wobei nicht gelöscht werden konnten "alchem.cab" und "TR/SecndThought.C.3 ...

leider ist gerade der Beitrag den ich gepostet hab mit dem report von antivir nicht durchgekommen hier, von daher hab ich den Antivir Report jetzt hier nicht, sorry.
______________________________

Hoffe mir kann noch geholfen werden...

vielen vielen dank im vorraus

Warum hast du Shadowdance´s Empfehlungen ignoriert?
Du verwendest immer noch den IE.
Was hat eScan gefunden?

Ja stimmt, *auch noch schuldig fühl*

also e scan hat mal folgendes gefunden:

- File C:\WINDOWS\PREINSTT.EXE infected by "not-a-virus:AdvWare.BiSpy.f" Virus. Action Taken: File Renamed

- File C:\WINDOWS\TWAINTEC.DLL infected by "not-a-virus:AdvWare.BiSpy.o" Virus. Action Taken: File Renamed.

- File C:\WINDOWS\TWAINTEC.DLL infected by "not-a-virus:AdvWare.BiSpy.o" Virus. Action Taken: File Renamed.

- File C:\WINDOWS\SYSTEM\id113.exe infected by "TrojanDownloader.Win32.SecondThought.ah" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\istinstall_adlogix.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\stcloader.exe infected by "Trojan.Win32.SecondThought.ai" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\2ndsrch.dll infected by "Trojan.Win32.SecondThought.ag" Virus. Action Taken: File Deleted

- File C:\WINDOWS\SYSTEM\TVM_B5 Bundle 25.EXE infected by "TrojanDropper.Win32.Small.ht" Virus. Action Taken: File Deleted

- File C:\WINDOWS\SYSTEM\setup_incred_8.exe infected by "TrojanDownloader.Win32.Keenval.e" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\WNZDUR.EXE infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted

- Process C:\Programme\ClearSearch\Loader.exe Found running in Memory...

- C:\PROGRAMME\CLEARSEARCH\LOADER.EXE infected by "Backdoor.Ruledor.e" Virus. Action Taken: File Renamed.

- Process C:\Program Files\Internet Optimizer\actalert.exe Found running in Memory...

- C:\PROGRA~2\INTERN~1\ACTALERT.EXE infected by "TrojanDownloader.Win32.Dyfuca.cr" Virus. Action Taken: File Deleted

- File C:\WINDOWS\ALCHEM.exe infected by "TrojanDownloader.Win32.Alchemic" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\istinstall_adlogix.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\istinstall_adlogix.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\POLALL1M.EXE infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\stcloader.exe infected by "Trojan.Win32.SecondThought.ai" Virus. Action Taken: File Deleted.

- File C:\WINDOWS\SYSTEM\2ndsrch.dll infected by "Trojan.Win32.SecondThought.ag" Virus. Action Taken: File to be deleted on reboot.

- File C:\WINDOWS\SYSTEM\IdleUI.dll infected by "TrojanSpy.Win32.Idly.c" Virus. Action Taken: File Deleted.

- File C:\_RESTORE\TEMP\A1411962.CPY infected by "not-a-virus:AdvWare.WebRebates.b" Virus. Action Taken: File to be renamed on reboot.

- File C:\_RESTORE\TEMP\A1411981.CPY infected by "not-a-virus:AdvWare.BookedSpace.c" Virus. Action Taken: File to be renamed on reboot.

- File C:\_RESTORE\TEMP\A1411987.CPY infected by "TrojanDropper.Win32.Small.ht" Virus. Action Taken: File to be deleted on reboot.

- File C:\_RESTORE\TEMP\A1412913.CPY infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File to be deleted on reboot.

- File C:\_RESTORE\TEMP\A1412914.CPY infected by "Backdoor.Ruledor.e" Virus. Action Taken: File to be renamed on reboot.

- File C:\_RESTORE\TEMP\A1412915.CPY infected by "TrojanDownloader.Win32.Dyfuca.cr" Virus. Action Taken: File to be deleted on reboot

- File C:\_RESTORE\TEMP\A1412964.CPY infected by "TrojanDownloader.Win32.Rameh.c" Virus. Action Taken: File to be deleted on reboot.

- File C:\_RESTORE\TEMP\A1412965.CPY infected by "TrojanDownloader.Win32.Alchemic" Virus. Action Taken: File to be deleted on reboot.

- File C:\_RESTORE\TEMP\A1412966.CPY infected by "not-a-virus:AdvWare.BiSpy.f" Virus. Action Taken: File to be renamed on reboot

- File C:\_RESTORE\TEMP\A1412967.CPY infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: File to be deleted on reboot.

- File D:\Antivir\INFECTED\OPTIMIZE.VIR infected by "TrojanDownloader.Win32.Dyfuca.cy" Virus. Action Taken: File Deleted.

- File D:\Antivir\INFECTED\WNZDUR.VIR infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted

- File D:\Antivir\INFECTED\ACTALERT.VIR infected by "TrojanDownloader.Win32.Dyfuca.cr" Virus. Action Taken: File Deleted

- File D:\Antivir\INFECTED\OPTIMIZE.VIR00 infected by "TrojanDownloader.Win32.Dyfuca.cy" Virus. Action Taken: File Deleted.

- File D:\Antivir\INFECTED\ACTALERT.VIR00 infected by "TrojanDownloader.Win32.Dyfuca.cr" Virus. Action Taken: File Deleted.

- File D:\Antivir\INFECTED\CSV5P070.VIR infected by "Backdoor.Ruledor.e" Virus. Action Taken: File Renamed

- File D:\backups\backup-20040907-144237-411.dll infected by "not-a-virus:AdvWare.BookedSpace.c" Virus. Action Taken: File Renamed.



Ich hoffe das bringt was .... danke nochmals

mein neues HijackThis logfile sieht nun so aus, könnte das nochmal jemand für mich checken? Wäre nett, danke!

Logfile of HijackThis v1.98.2
Scan saved at 20:01:15, on 11.09.2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMME\MAUS\POINT32.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAMME\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\TSMSVC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
D:\ICQLITE\ICQLITE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
D:\MP3 TOOLS\WINAMP\WINAMP.EXE
C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
D:\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE"
O4 - HKLM\..\Run: [ICQ Lite] D:\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /M "Stylus C84" /EF "HKCU"
O4 - HKCU\..\RunOnce: [ICQ Lite] D:\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: Verknüpfung mit point32.lnk = C:\Programme\Maus\point32.exe
O4 - Startup: Watchdog.lnk = C:\WINDOWS\TWAIN\A4s2\Watchdog.exe
O4 - Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Office.lnk = C:\Programme\Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\ICQLite\ICQLite.exe

Das Log-File ist zwar augenscheinlich sauber, aber bei der massiven Kompromittierung, würde ich dein System kein Vertrauen mehr schenken.
http://faq.underflow.de/#SECTION000120000000000000000
http://oschad.de/wiki/index.php/Kompromittierung

Solltest du diesen Zusatnd belassen, dann ändere sämtliche Passwörter.

Hallo zusammen

ich habe eine Frage kennt einer von euch den trojaner katien.n backdoor ???
ich hab den auf meinem labtop und habe ihn mit Microsoft spyware gelöscht doch er kommt immer wieder und verschickt eine Datei über den msn messenger doch ich seh die Datei nicht mehr es geht sehr schnell wieder weg und dan geht nichts mer... dan mach ich spyware und weg ist er bis ich den PC wieder anschalte und schon ist er wieder da...
bitte helft mir wenn möglich danke schon jetzt

lg mayo17