Trojan-Downloader.Win32.Zlob ist aktiv!
 

ich bekomme die viren einfach nicht weg
habe das ganze auch schon mit smitRem probiert aber auch das half nicht

HILFE HILFE HILFE

http://www.hijackthis.de/logfiles/4343497809c83754c20880b22e908f8e.html

Hallo deborah,

poste bitte hier Dein Hijackthis-Logfile. Alles andere wird zu unübersichtlich.

dartus

hoffe mir kann jemand helfen!!!

Logfile of HijackThis v1.99.1
Scan saved at 19:38:35, on 06.02.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\System32\nvctrl.exe
F:\WINDOWS\System32\mssearchnet.exe
F:\Programme\Java\jre1.5.0_04\bin\jusched.exe
F:\WINDOWS\System32\starter.exe
D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
D:\Programme\PC Booster\pcbooster.exe
F:\WINDOWS\System32\ctfmon.exe
F:\Programme\Messenger\msmsgs.exe
d:\Programme\Logitech\MouseWare\system\em_exec.exe
d:\Programme\AVPersonal\AVWUPSRV.EXE
F:\WINDOWS\System32\wuauclt.exe
F:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\kernel.exe
F:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis2\sc_watch.exe
F:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
F:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
d:\Programme\WinRAR\WinRAR.exe
F:\DOKUME~1\MICHL~1.KUR\LOKALE~1\Temp\Rar$EX17.086\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://F:\WINDOWS\icjul.dll/sp.html#60128
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: RandomName - {e0103cd4-d1ce-411a-b75b-4fec072867f4} - F:\WINDOWS\System32\hp4C0A.tmp
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - F:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] F:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [PPMemCheck] D:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] D:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Security iGuard] d:\Programme\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [addfs32.exe] F:\WINDOWS\system32\addfs32.exe
O4 - HKLM\..\Run: [PC Booster] d:\Programme\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [zBrowser Launcher] d:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - D:\Programme\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} - http://playroom.icq.com/odyssey_web11.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB7ECC51-FD6C-4794-8A89-C2F423ED7C69}: NameServer = 217.237.151.97 217.237.148.1
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - d:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - d:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: AntiVir Update Temp (TmpUpSrv) - Unknown owner - F:\DOKUME~1\MICHL~1.KUR\LOKALE~1\TEMP\_VWUPSRV.EXE (file missing)

Das System ist veraltet und ungepatcht:
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Schon mal was von Updates und SP2 gehört:mad:

Lasse folgende Dateien hier prüfen und teile das Ergebnis mit:
F:\WINDOWS\System32\nvctrl.exe
F:\WINDOWS\system32\addfs32.exe
F:\WINDOWS\System32\hp4C0A.tmp

hier

hier das erste resultat

Auslastung: 0% 100%

Datei: nvctrl.exe_
Status: INFIZIERT/MALWARE
Entdeckte Packprogramme: PE_PATCH, UPACK

AntiVir Keine Viren gefunden
ArcaVir Heur.Win32 gefunden
Avast Keine Viren gefunden
AVG Antivirus Generic.NKL gefunden
BitDefender Trojan.Downloader.Zlob.EO gefunden
ClamAV Trojan.Downloader.Zlob-168 gefunden
Dr.Web Keine Viren gefunden
F-Prot Antivirus Keine Viren gefunden
Fortinet W32/Puper.EO!dldr gefunden
Kaspersky Anti-Virus Trojan-Downloader.Win32.Zlob.eo gefunden
NOD32 a variant of Win32/StartPage.ADH gefunden
Norman Virus Control Keine Viren gefunden
UNA TrojanDownloader.Win32.Zlob gefunden
VBA32 Trojan-Downloader.Win32.Zlob.eo gefunden

bei den anderen beiden kommt das hier:

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

Hallo deborah,

führe folgendes punktgenau aus:
http://www.trojaner-board.de/showthread.php?t=21709

dartus

hab alles so gemacht wie beschrieben

hier die ergebnisse von Escan:
VIRUS LOG INFORMATION

File F:\WINDOWS\System32\ldE8E6.tmp infected by "Trojan-Downloader.Win32.Zlob.em" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\nvctrl.exe infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\mssearchnet.exe infected by "Trojan-Downloader.Win32.Zlob.ej" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\hpED33.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\hpED33.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\mscornet.exe infected by "Trojan-Downloader.Win32.Zlob.ei" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\nvctrl.exe infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\mssearchnet.exe infected by "Trojan-Downloader.Win32.Zlob.ej" Virus! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "showsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "cws.homesearch Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "precisionpop Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "trojan.zlob.e Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "bargainbuddy Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "ezula Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smartfinder Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smartfinder Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "kazaa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "smitfraud variant Browser Hijacker" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
Object "spywarestrike Trojan-Downloader" found in File System! Action Taken: No Action Taken.
File F:\WINDOWS\System32\logonui.exe infected by "Trojan.Win32.Agent.on" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\msvol.tlb infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\hpF594.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\hp85ED.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\System32\ldE8E6.tmp infected by "Trojan-Downloader.Win32.Zlob.em" Virus! Action Taken: No Action Taken.
File E:\Eigene Dateien2\UNZIPPED\PG3D-Ordner\AGSetup0608.exe tagged as "not-a-virus:AdWare.Win32.Gator.1050". Action Taken: No Action Taken.
File F:\WINDOWS\system32\dllcache\logonui.exe infected by "Trojan.Win32.Agent.on" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\logonui.exe infected by "Trojan.Win32.Agent.on" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\msvol.tlb infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\hpF594.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\hp85ED.tmp infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\WINDOWS\system32\ldE8E6.tmp infected by "Trojan-Downloader.Win32.Zlob.em" Virus! Action Taken: No Action Taken.
File F:\System Volume Information\_restore{422A7F76-FD06-4FB9-AE3D-CC26EF9D95A2}\RP518\A0319415.tlb infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\System Volume Information\_restore{422A7F76-FD06-4FB9-AE3D-CC26EF9D95A2}\RP519\A0319481.tlb infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.
File F:\System Volume Information\_restore{422A7F76-FD06-4FB9-AE3D-CC26EF9D95A2}\RP519\A0320385.tlb infected by "Trojan-Downloader.Win32.Zlob.eo" Virus! Action Taken: No Action Taken.

Hallo Deborah,
der hier steckt bei dir frin :
http://www.sophos.de/virusinfo/analyses/trojzlobce.html
Diese beiden Sachen sind demnach von ihm :
F:\WINDOWS\System32\nvctrl.exe
F:\WINDOWS\System32\mssearchnet.exe
Es kann für dich nur eins geben :Neuaufsetzen des Systems !!!
Hier ist eine Anleitung dazu :
http://www.trojaner-board.de/showthread.php?t=12154
Hältst du dich an diese Anleitung, stehen die Chancen sehr gut,das wir dich hier nicht wieder mit Problemen sehen werden.
Irrlicht