sp.html immer beim start bitte hilfe
 

Logfile of HijackThis v1.98.2
Scan saved at 13:39:59, on 12.11.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\savedump.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\ZipToA.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Outlook Express\msimn.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Microsoft Office\Office\1031\OLFSNT40.EXE
C:\WINNT\system32\wuauclt.exe
C:\Dokumente und Einstellungen\hoernig\Desktop\von Niko\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\system32\blank.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINNT\system32\blank.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINNT\system32\blank.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINNT\system32\blank.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {47C5CE46-082B-4ACC-9257-AAD860C3285F} - C:\WINNT\system32\hkij.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Symantec Fax Starter Edition-Anschluss.lnk = C:\Programme\Microsoft Office\Office\1031\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A444F50E-7AE6-4D46-A691-5D123565B227}: NameServer = 192.168.120.252,192.168.120.253
O17 - HKLM\System\CCS\Services\Tcpip\..\{F038D33A-8B11-4C33-A9AD-1F1F4D2DBE5C}: NameServer = 192.168.100.1,195.71.210.134
O18 - Filter: text/html - {FACCC4F3-0BE0-4887-A1BC-91366A19A621} - C:\WINNT\system32\hkij.dll
O18 - Filter: text/plain - {FACCC4F3-0BE0-4887-A1BC-91366A19A621} - C:\WINNT\system32\hkij.dll

@ think-sexy.de

lass mal bitte den eScan über Dein System laufen: lade den eScan runter - laut Anweisung -, erstelle dafür einen Ordner (=Verzeichnis) c:\bases, update den eScan online und führe ihn offline im abgesicherten Modus aus. Beachte dass der eScan ab Version 4.5.1 die gefundene Malware nicht löscht.

"Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." (Zitat Cidre) Teile uns das Ergebnis des eScan mit: welche Viren wurden auf Deinem Rechner gefunden.

SD

Tue Nov 09 10:32:24 2004 => **********************************************************
Tue Nov 09 10:32:24 2004 => eScan AntiVirus Toolkit Utility.
Tue Nov 09 10:32:24 2004 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Tue Nov 09 10:32:24 2004 => **********************************************************
Tue Nov 09 10:32:24 2004 => Version 4.6.2 (C:\DOKUME~1\hoernig\LOKALE~1\Temp\mwavscan.com)
Tue Nov 09 10:32:24 2004 => Log File: C:\DOKUME~1\hoernig\LOKALE~1\Temp\mwav.log
Tue Nov 09 10:32:24 2004 => Latest Date of files inside MWAV: 04 Nov 2004 07:00:42.
Tue Nov 09 10:32:26 2004 => AV Library Loaded...
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavss.exe
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\Getvlist.exe
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavss.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavssdi.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavssi.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavvlg.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\msvlclnt.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\ipc.dll
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\main.avi
Tue Nov 09 10:32:26 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\virus.avi
Tue Nov 09 10:32:26 2004 => Virus Database Date: 2004/11/04
Tue Nov 09 10:32:26 2004 => Virus Database Count: 108233

Tue Nov 09 10:32:33 2004 => **********************************************************
Tue Nov 09 10:32:33 2004 => eScan AntiVirus Toolkit Utility.
Tue Nov 09 10:32:33 2004 => Copyright © 2003-2004, MicroWorld Technologies Inc.
Tue Nov 09 10:32:33 2004 =>
Tue Nov 09 10:32:33 2004 => Support: support@mwti.net
Tue Nov 09 10:32:33 2004 => Web: http://www.mwti.net
Tue Nov 09 10:32:33 2004 => **********************************************************
Tue Nov 09 10:32:33 2004 => Version 4.6.2 (C:\DOKUME~1\hoernig\LOKALE~1\Temp\mwavscan.com)
Tue Nov 09 10:32:33 2004 => Log File: C:\DOKUME~1\hoernig\LOKALE~1\Temp\mwav.log
Tue Nov 09 10:32:33 2004 => Latest Date of files inside MWAV: 04 Nov 2004 07:00:42.

Tue Nov 09 10:32:33 2004 => Options Selected by User:
Tue Nov 09 10:32:33 2004 => Memory Check: Enabled
Tue Nov 09 10:32:33 2004 => Registry Check: Enabled
Tue Nov 09 10:32:33 2004 => StartUp Folder Check: Enabled
Tue Nov 09 10:32:33 2004 => System Folder Check: Enabled
Tue Nov 09 10:32:33 2004 => System Area Check: Disabled
Tue Nov 09 10:32:33 2004 => Services Check: Enabled
Tue Nov 09 10:32:33 2004 => Drive Check Option Disabled
Tue Nov 09 10:32:33 2004 => Folder Check: Disabled

Tue Nov 09 10:32:33 2004 => ***** Scanning Memory Files *****
Tue Nov 09 10:32:33 2004 => Scanning File C:\WINNT\SYSTEM32\CSRSS.EXE
Tue Nov 09 10:32:33 2004 => Scanning File C:\WINNT\SYSTEM32\WINLOGON.EXE
Tue Nov 09 10:32:33 2004 => Scanning File C:\WINNT\System32\smss.exe
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\ipc.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavss.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavss.exe
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavssd.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavssdi.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\kavssi.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\msvlclnt.dll
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\mwavscan.com
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\PSAPI.DLL
Tue Nov 09 10:32:34 2004 => Scanning File C:\DOKUME~1\hoernig\LOKALE~1\Temp\RICHED32.DLL
Tue Nov 09 10:32:34 2004 => Scanning File C:\WINNT\AppPatch\AcLayers.DLL
Tue Nov 09 10:32:34 2004 => Scanning File C:\WINNT\Explorer.EXE
Tue Nov 09 10:32:34 2004 => Scanning File C:\WINNT\system32\ACTIVEDS.DLL
Tue Nov 09 10:32:34 2004 => Scanning File C:\WINNT\system32\ADSLDPC.DLL
Tue Nov 09 10:32:34 2004 => Scanning File C:\WINNT\system32\ADVAPI32.DLL
Tue Nov 09 10:32:35 2004 => Scanning File C:\WINNT\system32\ATL.DLL
Tue Nov 09 10:32:35 2004 => Scanning File C:\WINNT\System32\AVIFIL32.DLL
Scanning File C:\WINNT\system32

hat keinen Virus gefunden ist nur die satrseite im iexplorer die nicht weg geht ? Jemand eine Ahnung was ich löschen soll ?

hi

bitte alle temp ordern leeren, tif löschen, verlauf leeren

bitte diese datei bei jotti oder kaspersky überprüfen lassen
C:\WINNT\system32\hkij.dll

http://www.trojaner-board.de/51130-a...kthis.html#o18