|
Warezov und andere Gesellen Hey Leutz, meine kleine Schwester schleppt mir gerade ihren laptop an, weil "irgendso ein Trojanerdingsbumms drauf ist..." Hab mir den Rechner dann ma angesehen und mit Antivir gleich mehrere Würmer gefunden. Konnte auch dank vielen Einträgen hier im Forum einiges selbst richten, zumindest glaub ich das. (kommen keine Meldungen mehr von Antivir) :confused: Hab aber das Gefühl, das der REchner noch nicht ganz sauber ist. Könntet ihr ma über das HJT Logfile schauen?? Entfernt hab ich u.a. Dropper DR/180 Solutions-AO.16 Warezov.Cu.6 Warezov.Hx Warezov.Hx.1 Warezov.EQ.1 Stration.Gen Stration.BL3 Stration.C1 Hier das Log: Logfile of HijackThis v1.99.1 Scan saved at 16:03:02, on 21.01.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Intel\Wireless\Bin\EvtEng.exe C:\Programme\Intel\Wireless\Bin\S24EvMon.exe C:\Programme\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\FRITZ!DSL\IGDCTRL.EXE c:\programme\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\Programme\Apoint\Apoint.exe C:\Programme\Java\jre1.5.0_03\bin\jusched.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe C:\Programme\Dell\QuickSet\quickset.exe C:\Programme\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe C:\Programme\Intel\Wireless\Bin\RegSrvc.exe C:\Programme\Apoint\Apntex.exe C:\Programme\iTunes\iTunesHelper.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Digital Line Detect\DLG.exe C:\Programme\FRITZ!DSL\StCenter.exe C:\Programme\iPod\bin\iPodService.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\WinRAR\WinRAR.exe C:\Programme\hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\programme\mcafee\spamkiller\mcapfbho.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Programme\AOL\AOL Toolbar 2.0\aoltb.dll O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Programme\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [Dell QuickSet] C:\Programme\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [DMXLauncher] C:\Programme\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [EPSON Stylus D78 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE /FU "C:\WINDOWS\TEMP\E_S14C.tmp" /EF "HKLM" O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: FRITZ!DSL Startcenter.lnk = C:\Programme\FRITZ!DSL\StCenter.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Programme\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\programme\mcafee\spamkiller\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\programme\mcafee\spamkiller\mcapfbho.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132997230084 O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab O18 - Protocol: haufereader - {39198710-62F7-42CD-9458-069843FA5D32} - C:\Programme\Haufe\HaufeReader\HRInstmon.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - AppInit_DLLs: vb5dmspo.dll e1.dll confbrw.dll brwstat.dll diagisr.dll O20 - Winlogon Notify: brwmgr - brwmgr32.dll (file missing) O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: slbipsch - C:\WINDOWS\system32\slbipsch.dll (file missing) O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programme\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Programme\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2006\WinStylerThemeSvc.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe Danke im Voraus!! :) |
Hallo. :) Es sind/waren einige Malware Einträge vorhanden: Zitat:
Arbeiten mit MWAV (eScan) * Lies dir folgende Anleitung genau durch und arbeite sie ab: -> Anleitung eScan * Wichtig: Poste im Anschluss das Ergebnis mit Hilfe der “find.bat”. (steht alles ganz genau in der Anleitung.) F-Secure Blacklight – Rootkitscanner: * Scanne dein System mit Blacklight- * Poste im Anschluss das Ergebnis des Reportes in dem du alles abkopierst und hier in einen Beitrag einfügst. (die Datei sollte auf C: angelegt werden.) Anleitung SmitfraudFix: Lade dir dieses Tool -> SmitfraudFix -Starte es dann und lass das System durchsuchen. (Option 1) -Poste danach wie in der Anleitung beschrieben, das Ergebnis des Scans Gruß Sunny |
Hey Sunny, hab gerade noch den online-check von kaspersky.com laufen...der hat mir auch schon einiges wieder angezeigt,... kannst du mit den ergebnissen von kaspersky auch arbeiten? Dann poste ich später das ergebnis. andernfalls arbeite ich deine liste ab und poste das dann. Danke schon ma! :party: |
Zitat:
|
hier das kaspersky-logfile: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, January 21, 2007 5:04:58 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 21/01/2007 Kaspersky Anti-Virus database records: 246005 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ F:\ Scan Statistics: Total number of scanned objects: 92503 Number of viruses found: 9 Number of infected objects: 98 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:17:33 Infected Object Name / Virus Name / Last Action C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee\SpamKiller\Logs\Filtering.log Object is locked skipped C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\McAfee.com\Agent\Logs\TaskScheduler\McTskshd000.log Object is locked skipped C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QSLLPSVCShare Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\cert8.db Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\googlesafebrowsing.db Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\history.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\key3.db Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\parent.lock Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Cookies\index.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\Cache\_CACHE_001_ Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\Cache\_CACHE_002_ Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\Cache\_CACHE_003_ Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\q4nuijvz.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Verlauf\History.IE5\index.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\Lokale Einstellungen\Verlauf\History.IE5\MSHist012007012120070122\index.dat Object is locked skipped C:\Dokumente und Einstellungen\Amrei\NTUSER.DAT Object is locked skipped C:\Dokumente und Einstellungen\Amrei\ntuser.dat.LOG Object is locked skipped C:\Dokumente und Einstellungen\LocalService\Cookies\index.dat Object is locked skipped C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Verlauf\History.IE5\index.dat Object is locked skipped C:\Dokumente und Einstellungen\LocalService\NTUSER.DAT Object is locked skipped C:\Dokumente und Einstellungen\LocalService\ntuser.dat.LOG Object is locked skipped C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Dokumente und Einstellungen\NetworkService\NTUSER.DAT Object is locked skipped C:\Dokumente und Einstellungen\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Programme\FRITZ!DSL\access\access.lock Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068430.pif Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068431.exe Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068432.dll Infected: Email-Worm.Win32.Warezov.hw skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068434.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068446.dll Infected: Email-Worm.Win32.Warezov.hw skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068449.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068460.dll Infected: Email-Worm.Win32.Warezov.hw skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068461.scr Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068462.exe Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068464.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068478.dll Infected: Email-Worm.Win32.Warezov.hw skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068479.exe Infected: Email-Worm.Win32.Warezov.hw skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068517.exe Infected: Email-Worm.Win32.Warezov.jh skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068519.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068532.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068546.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068575.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068671.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0068684.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0069684.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0069728.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0069792.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0069816.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP171\A0069829.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0069855.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0069882.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0069909.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0069985.exe Infected: Email-Worm.Win32.Warezov.fh skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0069989.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0070002.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0070043.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0070096.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP181\A0070117.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP182\A0070137.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP182\A0070153.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP182\A0070166.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP183\A0070190.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP183\A0070242.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP183\A0070255.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070296.exe Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070298.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070330.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070394.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070448.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070518.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070532.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070583.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070641.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070696.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070710.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP184\A0070753.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0070792.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0070818.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0070831.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0070849.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0072915.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0072953.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP185\A0072972.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP186\A0074000.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP186\A0075000.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP187\A0077021.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP187\A0077410.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP187\A0077417.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP187\A0077421.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP187\A0077425.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP188\A0077645.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP188\A0077947.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP189\A0078354.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP189\A0079354.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP189\A0079494.exe Infected: Email-Worm.Win32.Warezov.cu skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0079528.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0079928.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0080928.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0082930.dll Infected: Email-Worm.Win32.Warezov.dq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0083928.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0083932.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0085933.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086933.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086936.dll Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086937.dll Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086938.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086939.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086940.dll Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0086943.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0087943.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088008.exe Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088010.exe Infected: Email-Worm.Win32.Warezov.cu skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088011.exe Infected: Email-Worm.Win32.Warezov.ij skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088012.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088013.dll Infected: Email-Worm.Win32.Warezov.dq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088014.exe Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088015.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088016.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088017.dll Infected: Email-Worm.Win32.Warezov.hx skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088018.dll Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088019.dll Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088020.exe Infected: Email-Worm.Win32.Warezov.eq skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP190\A0088021.dll Infected: Email-Worm.Win32.Warezov.et skipped C:\System Volume Information\_restore{08A5F15B-D5F0-4D17-893D-8B358608DCF6}\RP191\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\dtscsi.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\drivers\sptd6653.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. :eek: |
Das sieht schlimmer aus als es ist. ;) Deaktiviere einfach die Systemwiederherstellung, starte danach das System neu, und alles sollte verschwunden sein was Kaspersky gefunden hat. ;) Systemwiederherstellung kann nun wieder aktiviert werden. Nun den Rest von mir posten.. |
na das klingt doch schon ganz zuversichtlich. Ich werd nu die systemwiederherstellung deaktivieren, neustarten und dann deine liste abarbeiten. wird wohl n bisschen dauern, bis ich die ergebnisse posten kann. Bis später dann. :huepp: :huepp: |
puhh..endlich kann ich die escan log posten... ich hab ma nur die Vireninfos gepostet,...der rest der logfile ist extrem lang und enthält nur die pfade in denen gesucht wurde,...brauchst die komplette file? die anderen beiden prüfungen stehen noch aus. Entry "HKCR\DirectAnimation.PathControl" refers to invalid object "{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}". Action Taken: Entries Removed. Entry "HKCR\DirectAnimation.Sequence" refers to invalid object "{4F241DB1-EE9F-11D0-9824-006097C99E51}". Action Taken: Entries Removed. Entry "HKCR\DirectAnimation.SequencerControl" refers to invalid object "{B0A6BAE2-AAF0-11D0-A152-00A0C908DB96}". Action Taken: Entries Removed. Entry "HKCR\DirectAnimation.SpriteControl" refers to invalid object "{FD179533-D86E-11D0-89D6-00A0C90833E6}". Action Taken: Entries Removed. Entry "HKCR\DirectAnimation.StructuredGraphicsControl" refers to invalid object "{369303C2-D7AC-11D0-89D5-00A0C90833E6}". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jasc Software Inc\Paint Shop Pro Studio\". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\Besitzer\Anwendungsdaten\Jasc Software Inc\". Action Taken: Entries Removed. Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mds". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{501BADCD-F8F7-44CB-AC3F-6ED25C1A28B5}". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{929408E6-D265-4174-805F-81D1D914E2A4}". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB873339". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB885250". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB885835". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB885855". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB887472". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB888113". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB888310". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB890175". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB891781". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB892627". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB893056". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB896422". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB896423". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB896727". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB899588". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB899591". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB901214". Action Taken: Entries Removed. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "QuickTime". Action Taken: Entries Removed. |
das progi blacklight hat keine probleme gefunden, ne logfile zum kopieren hab ich auch nicht entdeckt. aber mit smitfraudfix hab ich wat gefunden... SmitFraudFix v2.133 Scan done at 19:56:28,34, 21.01.2007 Run from C:\Dokumente und Einstellungen\Amrei\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Amrei »»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Amrei\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOKUME~1\Amrei\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Programme »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Die derzeitige Homepage" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"=" vb5dmspo.dll e1.dll confbrw.dll brwstat.dll diagisr.dll" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End :confused: |
Schiebe mal nach: Prüfe Dein System mit Ewido ewido - anti-spyware and anti-malware solutions Lasse alles löschen, was vorgeschlagen wird. Poste das Ergebnis, aber bitte lösche vorher aus dem Log alles was mit Cookies zu tun hat. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 16:44 Uhr. |
Copyright ©2000-2025, Trojaner-Board