Könnt ihr hier mal rein schauen?
 

Hallo zusammen,

ich habe seit ein paar Tagen das gefühl, dass mit meinem System etwas nciht stimmt.

Hier mal ein Logfile.

Wenn ihr noch etwas benötigt, nur sagen.

Logfile of HijackThis v1.99.1
Scan saved at 14:49:46, on 02.05.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\Mixer.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\winsystem.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Mozilla Firefox\firefox.exe
D:\Downloads\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jusos-aachen.de/typo3
F3 - REG:win.ini: run=
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [VVSN] C:\Programme\VVSN\VVSN.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Windows_Protect] winsystem.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\RunServices: [Windows_Protect] winsystem.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Windows_Protect] winsystem.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{5B331386-39AD-4CCE-BF1B-8A367ECFF505}: NameServer = 212.117.68.10 212.117.64.86
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

Hallo OliverAC,

laß bitte folgende Datei:

C:\WINDOWS\System32\winsystem.exe

hier online scannen:

http://virusscan.jotti.org/de

Teile bitte das Ergebnis mit.

dartus

Hallo dartus,

obwohl Hijack sagt, dass es eine C:\WINDOWS\System32\winsystem.exe gibt, kann ich sie nicht finden.

Lediglich eine WINSYSTEM.EXE-30119022.pf in C:\WINDOWS\Prefetch, dessen Scan unten steht.

Beim suchen nach der Datei bin ich zufällig auf C:\WINDOWS\SYSTEM32\WINSHOST.EXE gestoßen. AntiVir sagt mir, dass das Trojanische Pferd TR/Dldr.Bagle.BH.1 ist. Ein Scan über http://virusscan.jotti.org/de/ sagt mir das hier:
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file




Datei: WINSYSTEM.EXE-30119022.pf
Status:
OK
Entdeckte Packprogramme:
-

AntiVir
Keine Viren gefunden
Avast
Keine Viren gefunden
AVG Antivirus
Keine Viren gefunden
BitDefender
Keine Viren gefunden
ClamAV
Keine Viren gefunden
Dr.Web
Keine Viren gefunden
F-Prot Antivirus
Keine Viren gefunden
Fortinet
Keine Viren gefunden
Kaspersky Anti-Virus
Keine Viren gefunden
mks_vir
Keine Viren gefunden
NOD32
Keine Viren gefunden
Norman Virus Control
Keine Viren gefunden
VBA32
Keine Viren gefunden

@OliverAC
Ein gutes Gefühl:
Es fehlt WinXP SP2
Du musst umgehend entweder eine CD-ROM Bestellen oder SP 2 Direkt von Microsoft Homepage downloaden
Mach bitte noch Folgendes:
1.Systemwiederherstellung abschalten
2. Dieses Bereinigungsprogramm hilft dir, den ganzen Müll aus den Temp-Ordner und Papierkorb zu entfernen.
3. Infected-Ordner des Antivirus-Programms, ggf. auch von Spybot Search & Destroy, Ad-Aware usw. leeren. Der Name des Ordners sowie Pfad sind Programm- und Benutzerabhängig. Bitte RTFM zum AV-Programm. Bei einigen Programmen (z. B. AVPE) ist diese Option nicht im Programm integriert. In dem Fall soll dies manuell erfolgen.
4. eScan genau nach Anleitung (bitte ausdrucken und aufmerksam lesen) im abgesicherten Modus laufen lassen. Log hier Posten.

Zunächst vielen Dank an euch beide.

Ich werde das jetzt mal alles machen und euch berichten.

Hier eScan Log:


Mon May 02 16:13:18 2005 => ***** Scanning Registry Files *****

Mon May 02 16:13:18 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
Mon May 02 16:13:18 2005 => Scanning File C:\WINDOWS\system32\SHELL32.dll
Mon May 02 16:13:18 2005 => Scanning File C:\WINDOWS\system32\SHELL32.dll
Mon May 02 16:13:18 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:18 2005 => Scanning File C:\WINDOWS\System32\stobject.dll

Mon May 02 16:13:18 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

Mon May 02 16:13:18 2005 => Scanning HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension

Mon May 02 16:13:18 2005 => Scanning HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
Mon May 02 16:13:18 2005 => Scanning File C:\WINDOWS\System32\msdxm.ocx
Mon May 02 16:13:18 2005 => Scanning File C:\PROGRA~1\NORTON~1\NavShExt.dll

Mon May 02 16:13:19 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
Mon May 02 16:13:19 2005 => {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} = C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
Mon May 02 16:13:19 2005 => Scanning File C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\ACROIE~1.OCX
Mon May 02 16:13:19 2005 => {53707962-6F74-2D53-2644-206D7942484F} = C:\Programme\Spybot - Search & Destroy\SDHelper.dll
Mon May 02 16:13:19 2005 => Scanning File C:\PROGRA~1\SPYBOT~1\SDHelper.dll
Mon May 02 16:13:19 2005 => {BDF3E430-B101-42AD-A544-FADC6B084872} = C:\Programme\Norton AntiVirus\NavShExt.dll
Mon May 02 16:13:19 2005 => Scanning File C:\PROGRA~1\NORTON~1\NavShExt.dll

Mon May 02 16:13:19 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler
Mon May 02 16:13:19 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:19 2005 => Scanning File C:\WINDOWS\System32\browseui.dll

Mon May 02 16:13:19 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Mon May 02 16:13:19 2005 => Scanning File C:\WINDOWS\system32\mmsys.cpl
Mon May 02 16:13:19 2005 => Scanning File C:\WINDOWS\system32\icmui.dll
Mon May 02 16:13:19 2005 => Scanning File C:\WINDOWS\system32\rshx32.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\docprop.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\ntshrui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\System32\themeui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\deskadp.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\deskmon.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\dssec.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\SlayerXP.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\shscrap.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\diskcopy.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\ntlanui2.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\System32\icmui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\icmui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\printui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\dskquoui.dll
Mon May 02 16:13:20 2005 => Scanning File C:\WINDOWS\system32\syncui.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\System32\hticons.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\fontext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\icmui.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\rshx32.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\ntshrui.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\deskperf.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\cryptext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\cryptext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\NETSHELL.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\NETSHELL.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\wiashext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\wiashext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\wiashext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\wiashext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\system32\wiashext.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\System32\remotepg.dll
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\System32\wuaucpl.cpl
Mon May 02 16:13:21 2005 => Scanning File C:\WINDOWS\System32\wshext.dll
Mon May 02 16:13:22 2005 => Scanning File C:\PROGRA~1\GEMEIN~1\System\OLEDB~1\oledb32.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\mstask.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\mstask.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\mstask.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shmedia.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\browseui.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\system32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\shdocvw.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\sendmail.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\sendmail.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\occache.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\webcheck.dll
Mon May 02 16:13:22 2005 => Scanning File C:\WINDOWS\System32\appwiz.cpl
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\appwiz.cpl
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\appwiz.cpl
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\shimgvw.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\netplwiz.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\netplwiz.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\netplwiz.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\netplwiz.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\zipfldr.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\zipfldr.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\zipfldr.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\msieftp.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\docprop2.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsquery.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsquery.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsquery.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsquery.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsuiext.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\dsuiext.dll
Mon May 02 16:13:23 2005 => Scanning File C:\WINDOWS\System32\mydocs.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\mydocs.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\mydocs.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\cscui.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\cscui.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\cscui.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\msagent\AgentPsh.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\dfsshlex.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\photowiz.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\mmcshext.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\system32\cabview.dll
Mon May 02 16:13:24 2005 => Scanning File C:\PROGRA~1\OUTLOO~1\wabfind.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\wmpshell.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\wmpshell.dll
Mon May 02 16:13:24 2005 => Scanning File C:\WINDOWS\System32\wmpshell.dll
Mon May 02 16:13:24 2005 => Scanning File C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
Mon May 02 16:13:25 2005 => Scanning File C:\PROGRA~1\OOSOFT~1\SAFEER~1\oosesh.dll
Mon May 02 16:13:25 2005 => Scanning File C:\Programme\WinRAR\rarext.dll
Mon May 02 16:13:25 2005 => Scanning File C:\Programme\Real\RealPlayer\rpshell.dll
Mon May 02 16:13:25 2005 => Scanning File C:\WINDOWS\System32\Audiodev.dll
Mon May 02 16:13:25 2005 => Scanning File C:\WINDOWS\System32\Audiodev.dll
Mon May 02 16:13:25 2005 => Scanning File C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
Mon May 02 16:13:26 2005 => Scanning File C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
Mon May 02 16:13:26 2005 => Scanning File C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
Mon May 02 16:13:26 2005 => Scanning File C:\PROGRA~1\WINZIP\WZSHLSTB.DLL
Mon May 02 16:13:26 2005 => Scanning File C:\Programme\OpenOffice\program\shlxthdl.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\System32\cdfview.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\System32\cdfview.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\System32\cdfview.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\System32\cdfview.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\System32\cdfview.dll

Mon May 02 16:13:26 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

Mon May 02 16:13:26 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\Explorer.exe
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\userinit.exe
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\fdeploy.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\dskquota.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\gptext.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\gptext.dll
Mon May 02 16:13:26 2005 => Scanning File C:\WINDOWS\system32\scecli.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\iedkcs32.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\scecli.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\appmgmts.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\gptext.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\crypt32.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\cryptnet.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\cscdll.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\wlnotify.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\wlnotify.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\sclgntfy.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\WlNotify.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\wlnotify.dll
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\wlnotify.dll

Mon May 02 16:13:27 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Mon May 02 16:13:27 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Mon May 02 16:13:27 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Mon May 02 16:13:27 2005 => ERROR!!! Invalid Entry run = (in key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows). Removing it.

Mon May 02 16:13:27 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AEDEBUG
Mon May 02 16:13:27 2005 => Scanning File C:\WINDOWS\system32\drwtsn32.exe

Mon May 02 16:13:28 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\ntsd.exe

Mon May 02 16:13:28 2005 => Scanning HKCU\Control Panel\Desktop
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\System32\logon.scr

Mon May 02 16:13:28 2005 => Scanning HKLM\SYSTEM\CurrentControlSet\Control\WOW
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\ntvdm.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\ntvdm.exe

Mon May 02 16:13:28 2005 => Scanning HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\inf\unregmp2.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\RunDLL32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\regsvr32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\PROGRA~1\OUTLOO~1\setup50.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\rundll32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\rundll32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\rundll32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\PROGRA~1\OUTLOO~1\setup50.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\system32\regsvr32.exe
Mon May 02 16:13:28 2005 => Scanning File C:\WINDOWS\System32\ie4uinit.exe
Mon May 02 16:13:29 2005 => Scanning File C:\WINDOWS\System32\updcrl.exe
Mon May 02 16:13:29 2005 => Scanning File C:\WINDOWS\system32\rundll32.exe

Mon May 02 16:13:29 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Mon May 02 16:13:29 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Mon May 02 16:13:29 2005 => Scanning HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Run

Mon May 02 16:13:29 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run

Mon May 02 16:13:29 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Mon May 02 16:13:29 2005 => Scanning File C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE
Mon May 02 16:13:30 2005 => Scanning File C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE
Mon May 02 16:13:30 2005 => Scanning File C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE
Mon May 02 16:13:30 2005 => Scanning File C:\Programme\Java\j2re1.4.2_04\bin\jusched.exe
Mon May 02 16:13:30 2005 => Scanning File C:\WINDOWS\system32\dumprep.exe
Mon May 02 16:13:30 2005 => ERROR!!! Invalid Entry VVSN = C:\Programme\VVSN\VVSN.exe (in key SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Removing it.
Mon May 02 16:13:30 2005 => Scanning File C:\WINDOWS\Mixer.exe
Mon May 02 16:13:31 2005 => Scanning File C:\PROGRA~1\GEMEIN~1\Real\UPDATE~1\REALSC~1.EXE
Mon May 02 16:13:31 2005 => Scanning File C:\WINDOWS\system32\winsystem.exe
Mon May 02 16:13:42 2005 => File C:\WINDOWS\system32\winsystem.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.

Mon May 02 16:13:42 2005 => Scanning File C:\Programme\AVPersonal\AVGNT.EXE

Mon May 02 16:13:42 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Mon May 02 16:13:42 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Mon May 02 16:13:42 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Mon May 02 16:13:42 2005 => Scanning File C:\WINDOWS\system32\winsystem.exe

Mon May 02 16:13:42 2005 => Scanning HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

Mon May 02 16:13:42 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Mon May 02 16:13:42 2005 => Scanning File C:\WINDOWS\System32\ctfmon.exe
Mon May 02 16:13:42 2005 => Scanning File C:\WINDOWS\system32\winsystem.exe

Mon May 02 16:13:42 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Mon May 02 16:13:42 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

Mon May 02 16:13:43 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

Mon May 02 16:13:43 2005 => Scanning HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup

Mon May 02 16:13:43 2005 => Scanning HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Mon May 02 16:13:43 2005 => Scanning File C:\WINDOWS\System32\CTFMON.EXE
Mon May 02 16:13:43 2005 => Scanning File C:\WINDOWS\system32\winsystem.exe

Mon May 02 16:13:43 2005 => Scanning HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Mon May 02 16:13:43 2005 => Scanning HKCR\txtfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\comfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\exefile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\dllfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\batfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\piffile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\scrfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\scrfile\shell\config\command

Mon May 02 16:13:43 2005 => Scanning HKCR\regfile\shell\open\command

Mon May 02 16:13:43 2005 => Scanning HKCR\htmlfile\shell\open\command
Mon May 02 16:13:43 2005 => Scanning File C:\PROGRA~1\INTERN~1\iexplore.exe

Mon May 02 16:13:43 2005 => Scanning HKCR\htafile\shell\open\command
Mon May 02 16:13:43 2005 => Scanning File C:\WINDOWS\System32\mshta.exe

Mon May 02 16:13:43 2005 => Scanning HKCR\jsfile\shell\open\command
Mon May 02 16:13:43 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Mon May 02 16:13:44 2005 => Scanning HKCR\jsefile\shell\open\command
Mon May 02 16:13:44 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Mon May 02 16:13:44 2005 => Scanning HKCR\vbsfile\shell\open\command
Mon May 02 16:13:44 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Mon May 02 16:13:44 2005 => Scanning HKCR\vbefile\shell\open\command
Mon May 02 16:13:44 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Mon May 02 16:13:44 2005 => Scanning HKCR\wshfile\shell\open\command
Mon May 02 16:13:44 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Mon May 02 16:13:44 2005 => Scanning HKCR\wsffile\shell\open\command
Mon May 02 16:13:44 2005 => Scanning File C:\WINDOWS\System32\WScript.exe

Was auch immer du gepostet hast, es ist nicht der relevante Teil.
=> Speichere diese Datei mittels Rechtsklick-> "Ziel speichern unter..." auf deiner Festplatte. Führe sie nach dem Scan mit eScan aus (Doppelklick). Danach solltest du die Datei c:\eScan_neu.txt auf deiner Festplatte finden. Den Inhalt dieser Datei postest du dann bitte in diesen Thread.

So, der Scan hat fast 1,5 Stunden gedauert und eScan hat auch einiges gefunden.

Eine eScan_neu.txt wurde aber nicht erstellt. Das ganze Log kann ich hier auch nicht posten.

Was nun?

Ich scheine ihn hier --> W32.Velkbot.A auf der Platte zu haben.

Hallo OliverAC,

Du hast wahrscheinlich folgendes nicht eingestellt, um die "winsystem.exe" zu finden: Öffne den Explorer-->Extras-->Ordneroptionen-->Ansicht-->Systendateien ausblenden "häckchen weg“ und "Alle Dateien und Ordner Anzeigen" anklicken

Das folgende Scanergebnis war fast klar:
Bei einem Trojaner mit Backdoorfunktionalität wird Dir dringend zur Neuinstallation geraten.

Empfohlene Anleitung zur Neuinstallation

http://www.trojaner-board.de/showthread.php?t=12154

Thema Datensicherung:

http://www.trojaner-board.de/showpos...8&postcount=11

dartus

Hallo zusammen,

habe mein System soweit neu installiert.

Bei der Installation etlicher Programme sagt XP mir aber jetzt, dass ich nciht genügend Rechte für die Inst. besitze.

Habe ich bei der Install. von XP etwas falsch gemacht?

---

Die Edit bringt noch eben ein aktuelles Log von hj:

Logfile of HijackThis v1.99.1
Scan saved at 02:26:59, on 03.05.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\Dokumente und Einstellungen\*\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC1FC9E6-6DC0-4956-B076-895255518378}: NameServer = 212.117.68.10 212.117.64.86
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE

Ja, du hast den Link von Dartus nicht umgesetzt:

http://www.trojaner-board.de/showthread.php?t=12154

Service Pack 2 ist nicht drauf, der Internet Explorer veraltet

Setz dein System erneut auf und sicher es vor der ersten Internetverbindung wie oben im Link beschrieben ab.
Sollten die Fehlermeldungen erneut auftreten, sag Bescheid.
Das war ein gänzlich schlechter Start für ein neues System.