Trojaner-Board - Trojaner FAVADD

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Trojaner FAVADD (https://www.trojaner-board.de/10091-trojaner-favadd.html)

Hallo,
Weiss jemand was über den Trojaner FAVADD?
Norton hat diesen entdeckt,konnte ihn aber nicht löschen.
Mein Logfile:
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\taskswitch.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\de-ch\msnappau.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe
C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\w?nspool.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\nzaborsky\Local Settings\Temp\Temporary Directory 1 for hijackthis1982.zip\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sis.ehl.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sis
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sis/SIS/Documents/Information...Booklet_FR.pdf
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.root.ehl.ch:8080;https=proxy.root.ehl.ch:8080;ftp=proxy.root.ehl.ch:8080;gopher=proxy.root.ehl.ch:8080;socks=proxy.root.ehl.ch:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = galopa;apps.sis;sis;arbok;*.aehl.ch;*.aehl.net;*.aehl.org;*.ehl.ch;*.ehl.edu;*.lhcconsulting.com;*.lhc-consulting.com;<local>
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {6AAD6C7B-B560-79BD-D504-16550E87723A} - C:\WINDOWS\System32\crdwfzi.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\de-ch\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {D07EB1CB-8CDD-483E-8593-33BC94A98BC2} - C:\WINDOWS\System32\mfohfga.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\de-ch\msntb.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\de-ch\msnappau.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [wkbahwroc] C:\WINDOWS\System32\uvucivz.exe
O4 - HKLM\..\Run: [sais] c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Saot] C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
O4 - HKCU\..\Run: [Eczomg] C:\WINDOWS\System32\w?nspool.exe
O4 - Startup: BlueSpace NE.lnk = C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxdm41440CH
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O14 - IERESET.INF: START_PAGE_URL=http://sis
O15 - Trusted Zone: http://*.apps.sis
O15 - Trusted Zone: http://apps.sis.root.ehl.ch
O15 - Trusted Zone: http://sis.ehl.ch
O15 - Trusted Zone: http://sis.root.ehl.ch
O15 - Trusted Zone: http://*.sis
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...tup1.0.0.8.cab
O16 - DPF: {297F2B65-017C-11D5-A128-00D0B7869AD6} (SpectorPhotoUploader Control) - http://www.extrafilm.ch/import/spu.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {6F1AF9D5-68BB-4A81-93F1-481CB8AB0D0B} (PhotocolorUploader Control) - http://web1.photocolor.net/ActiveX/P...orUploader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\Software\..\Telephony: DomainName = student.root.ehl.ch
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\WINDOWS\Downloaded Program Files\mimectl.dll

Könnt ihr mir helfen?Kenne mich nicht wirklich aus bei so Sachen :balla:
Vielen Dank

@Neda
kuckst du hier
http://www.sophos.de/virusinfo/analy...ojfavaddd.html
lade dir spybot hier
und lasse das programm einen scan machen, alles was gefunden wird, löschen.
der DSO Exploit ist ein spybot bug, kannst nicht löschen.
danach bitte escan hier downloaden
anleitung hier
mache es genau wie es beschrieben wird.
danach nur die gefundenen ergebnisse von escan und ein neues HJT logfile hier posten.
escan dauert mindestens eine stunde, in dieser zeit kannst dein surfverhalten überlegen ;)

chaosman

Danke für die schnelle Antwort!
Werde auf jeden Fall mein surfverhalten überdenken-bin aber leider nicht alleinbenützerin :heilig:
Hab deinen rat befolgt,folgende liessen sich jedoch nicht löschen:
ESCAN:
File C:\DOCUME~1\NZABOR~1\APPLIC~1\oerr.exe tagged as not-a-virus:AdWare.PurityScan.w. No Action Taken.
File C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL tagged as not-a-virus:AdWare.NewDotNet. No Action Taken.
File C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL tagged as not-a-virus:AdWare.NewDotNet. No Action Taken.
File C:\DOCUME~1\NZABOR~1\APPLIC~1\oerr.exe tagged as not-a-virus:AdWare.PurityScan.w. No Action Taken.
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
LOGFILE:
Logfile of HijackThis v1.98.2
Scan saved at 02:33:29, on 11/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\Program Files\PowerPanel\Program\PcfMgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ICO.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\Program Files\Sony\HotKey Utility\HKserv.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\taskswitch.exe
C:\Program Files\Sony\HotKey Utility\HKWnd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\de-ch\msnappau.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe
C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\w?nspool.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\mwavscan.com
C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\kavss.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\nzaborsky\Local Settings\Temp\Temporary Directory 3 for hijackthis1982.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sis.ehl.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sis
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://sis/SIS/Documents/Information...Booklet_FR.pdf
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.root.ehl.ch:8080;https=proxy.root.ehl.ch:8080;ftp=proxy.root.ehl.ch:8080;gopher=proxy.root.ehl.ch:8080;socks=proxy.root.ehl.ch:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = galopa;apps.sis;sis;arbok;*.aehl.ch;*.aehl.net;*.aehl.org;*.ehl.ch;*.ehl.edu;*.lhcconsulting.com;*.lhc-consulting.com;<local>
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\de-ch\msntb.dll (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe
O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Saot] C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
O4 - HKCU\..\Run: [Eczomg] C:\WINDOWS\System32\w?nspool.exe
O4 - Startup: BlueSpace NE.lnk = C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O4 - Global Startup: PowerPanel.lnk = ?
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxdm41440CH
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://sis
O15 - Trusted Zone: http://*.apps.sis
O15 - Trusted Zone: http://apps.sis.root.ehl.ch
O15 - Trusted Zone: http://sis.ehl.ch
O15 - Trusted Zone: http://sis.root.ehl.ch
O15 - Trusted Zone: http://*.sis
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {297F2B65-017C-11D5-A128-00D0B7869AD6} (SpectorPhotoUploader Control) - http://www.extrafilm.ch/import/spu.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {6F1AF9D5-68BB-4A81-93F1-481CB8AB0D0B} (PhotocolorUploader Control) - http://web1.photocolor.net/ActiveX/P...orUploader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\Software\..\Telephony: DomainName = student.root.ehl.ch
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\WINDOWS\Downloaded Program Files\mimectl.dll :confused:

Hallo Neda,

kannst uns bitte das Gesamtergebnis des eScan mitteilen? Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." (Zitat Cidre)

=>Total Number of Files Scanned:
=>Total Number of Virus(es) Found:
***** Scanning complete. *****

SD

Hoffe ich machs jetzt richtig.....Schick Dir jetzt einfach das von den letzten Tagen, hab schon paar Sachen gelöscht...:

File C:\WINDOWS\nem220.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\egdi32.exe infected by "TrojanDownloader.Win32.Agent.bj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\etool.exe infected by "Trojan.Win32.Small.aj" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\optimize.exe infected by "TrojanDownloader.Win32.Dyfuca.da" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\sidefind.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Fri Nov 26 19:20:16 2004 => Total Files Scanned: 3250
Fri Nov 26 19:20:16 2004 => Total Virus(es) Found: 17
------------------------------------------------------
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Sat Nov 27 01:20:07 2004 => Total Files Scanned: 3245
Sat Nov 27 01:20:07 2004 => Total Virus(es) Found: 9
-------------------------------------------------------
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Sat Nov 27 02:20:55 2004 => Total Files Scanned: 3204
Sat Nov 27 02:20:55 2004 => Total Virus(es) Found: 5
-------------------------------------------------------
File C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken.

Sun Nov 28 01:34:42 2004 => Total Files Scanned: 3173
Sun Nov 28 01:34:43 2004 => Total Virus(es) Found: 3
-------------------------------------------------------

Dankeschön............

@ Neda

Platform: Windows XP SP1 (WinNT 5.01.2600) - lade Dir bitte das aktuelle Service Pack runter und update Deinen IE: www.windowsupdate.com

Überprüfe mit virusscan.jotti.dhs.org:

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 6.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe
C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
C:\WINDOWS\system32\w?nspool.exe
C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe

teile uns das Ergebnis der Überprüfung mit.

Boote in den abgesicherten Modus, deaktiviere die Systemwiederherstellung, und fixe mit Hijack This (Häk'chen setzen und auf Fix Checked klicken):

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\de-ch\msntb.dll (file missing)
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - h**p://bar.mywebsearch.com/menusear...?p=ZNxdm41440CH
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

wenn Du diese Einträge nicht kennst/brauchst, bitte ebenfalls fixen:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://sis.ehl.ch/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://sis
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://sis/SIS/Documents/Informatio..._Booklet_FR.pdf
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = galopa;apps.sis;sis;arbok;*.aehl.ch;*.aehl.net;*.aehl.org;*.ehl.ch;*.ehl.edu;*.l hcconsulting.com;*.lhc-consulting.com;
O14 - IERESET.INF: START_PAGE_URL=h**p://sis
O15 - Trusted Zone: h**p://*.apps.sis
O15 - Trusted Zone: h**p://apps.sis.root.ehl.ch
O15 - Trusted Zone: h**p://sis.ehl.ch
O15 - Trusted Zone: h**p://sis.root.ehl.ch
O15 - Trusted Zone: h**p://*.sis

O16 - DPF: {297F2B65-017C-11D5-A128-00D0B7869AD6} (SpectorPhotoUploader Control) - h**p://www.extrafilm.ch/import/spu.cab
O16 - DPF: {6F1AF9D5-68BB-4A81-93F1-481CB8AB0D0B} (PhotocolorUploader Control) - h**p://web1.photocolor.net/ActiveX/...lorUploader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - h**p://www.live365.com/players/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\Software\..\Telephony: DomainName = student.root.ehl.ch
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = student.root.ehl.ch
O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\WINDOWS\Downloaded Program Files\mimectl.dll

boote in den normalen Modus.

beende:
MWSOEMON.EXE

lösche:
C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\de-ch\msntb.dll (file missing)
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE

Aktiviere die Systemwiederherstellung.

Überprüfe Dein System bitte nochmals mit dem neu geupdateten eScan im abgesicherten Modus offline.

SD

Zitat:

Sun Nov 28 01:34:42 2004 => Total Files Scanned: 3173
Sun Nov 28 01:34:43 2004 => Total Virus(es) Found: 3

Ich halte es für unglaubwürdig, dass du dein ganzes System gescannt hast. Führe eScan erneut durch und wähle diesmal die Option "all local drives"

hi

erstens sollte beim scan mit hijackthis der internetexplorer geschlossen sein, bei dir ist er 3x geöffnet :nixda:

zweitens sollte Hijackthis aus einem eigenen ordner, am besten so C:\Programme\HijackThis\HJT.exe und nicht so
C:\Documents and Settings\nzaborsky\Local Settings\Temp\Temporary Directory 3 for hijackthis1982.zip\HijackThis.exe , dann klappt es auch mit dem backup :nixda:
drittens hast du die anleitung nicht gelesen von escan
C:\DOCUME~1\NZABOR~1\LOCALS~1\Temp\mwavscan.com soll im ordner
c:\bases ausgeführt werden, sonst funzt es nicht :nixda:

Ergebnisse des virusscan.jotti :

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 6.exe :
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

C:\WINDOWS\Logi_MwX.Exe :
MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.)

C:\Documents and Settings\nzaborsky\Application Data\oerr.exe :
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain in the ass -, results will not be stored in the database.)
Packers detected: UPX ------>
BitDefender Trojan.PurityScan.W
ClamAV Trojan.Dropper.Purityscan.I
Dr.Web not a virus Adware.ClickSpring
F-Prot Antivirus W32/Spybot.BMO
Kaspersky Anti-Virus not-a-virus:AdWare.PurityScan.w

C:\Program Files\Sony\BlueSpace\BlueSpaceNE.exe :
OK

C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe :
OK

C:\WINDOWS\system32\w?nspool.exe :
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe :
OK

@ Passat2002

DANKE für's mitlesen ... das hatte ich übersehen ... :daumenhoc

@ Neda

sende bitte diese Dateien

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 6.exe
C:\WINDOWS\Logi_MwX.Exe
C:\Documents and Settings\nzaborsky\Application Data\oerr.exe
C:\WINDOWS\system32\w?nspool.exe

passwortgeschützt (mit Angabe des Passworts in der Mail) an partytime-germany.ice@web.de und virus@hijackthis.de, mit Hinweis auf diesen Thread - zu Forschungszwecken.

Lies bitte die Anleitung zum eScan nochmal genau durch und scanne Dein System nochmal gründlich.

SD

ok mach ich gleich......ist schon am scannen.....
Danke Euch allen....kenne mich sooo nicht aus, aber werde mir Mühe geben...... :o

@ Neda,

lesen kannst Du aber? (siehe eScan Anleitung) Du musst für den eScan einen neuen Ordner (=Verzeichnis) "c:\bases" erstellen. Update den eScan online (siehe Anleitung) und führe ihn offline im abgesicherten Modus aus.

SD

ja, habs auch schon begriffen.................bin dabei.....................

SD meint das so, weil du online bist ;)
Sitzt du evtl vor einem Zweit-PC?

:confused: das funktioniert nicht mim abgesicherten modus....habs x mal genauso wies da steht probiert.......?!?!?!