Trojaner-Board - Hilfe! Computervirus lässt PC herunterfahren

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Hilfe! Computervirus lässt PC herunterfahren (https://www.trojaner-board.de/10633-hilfe-computervirus-laesst-pc-herunterfahren.html)

Moer	10.12.2004 19:54

Hilfe! Computervirus lässt PC herunterfahren

Hallo und Hilfe!! :heulen:

Irgendwelche Viren haben mein System befallen. Wenn ich ins Internet gehe kommt nach ca. 1 Minute die Nachricht, dass wegen C:\WINDOWS\SYSTEM32.lsass.exe der Computer heruntergefahren wird. Ich habe es mit mehreren Antivirus Programmen im abgesicherten Modus versucht wie Spybot Search und Ad Aware. Außerdem benutzte ich HijackThis, habe aber alle mir verdächtigen Dateien gelöscht und die sind übrig geblieben:

Logfile of HijackThis v1.98.2
Scan saved at 18:31:11, on 10.12.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\DOKUME~1\SCHNEI~1\LOKALE~1\Temp\mwavscan.com
C:\DOKUME~1\SCHNEI~1\LOKALE~1\Temp\kavss.exe
C:\Programme\Microsoft Office\Office10\WINWORD.EXE
C:\Dokumente und Einstellungen\Schneider\Desktop\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

Dazu haben ich auch noch E-scan ausgeführt und diese lange Liste erhalten. Wäre sehr nett, wenn mir jemand helfen könnte!!!
Moritz

File C:\WINDOWS\telnet.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent48.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msmsgsui.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent_install.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bhosave.dat infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\MSMSGSVC.exe infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\silent48[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\protector[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\bobby[1].exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\protector_update[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\24WEN45B\silent_install[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\bhosave.dat infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\telnet.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent48.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msmsgsui.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.

Es geht noch weiter leider reicht der Platz nicht aus....
Vielleicht könnt ihr schon daraus erkennen wo der wurm drinsteckt. Danke im Voraus!!

cacatoa

11.12.2004 18:16

Hi,
1. Das ist nie und nimmer das ganze Logfile, oder?
2. Ja, man kann was erkennen --> Lade Dir erst mal clearprog 1.4.0 final runter und mache alle Häkchen bei IE und Windows. Drücke dann auf "löschen", wenn fertig auf "beenden".
Dann erstellst du ein HJT Logfile im normalen Modus und postest das komplette Logfile hier rein. Dann gehts weiter.
cacatoa

Moer	11.12.2004 19:08

Vielen Dank CACATOA!!
habe clear prog durchlaufen lassen (allerding 1.4.1 final auch OK oder?)
Hier die Logfile von Hijackthis (brauchst du auch die von Escan?)
lieben gruss
moritz :)

Logfile of HijackThis v1.98.2
Scan saved at 19:02:14, on 11.12.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\WINDOWS\System32\atievxx.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\Explorer.EXE
C:\Dokumente und Einstellungen\Schneider\Desktop\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

cacatoa

11.12.2004 19:09

Ja, wenn Du schon ein neues eScan Logfile hast, dann rein damit! ;)

cacatoa

11.12.2004 19:10

Dein Logfile ist absolut sauber; aber es ist so kurz - hast Du wirklich nicht mehr laufen - oder was nicht reinkopiert?

Moer	11.12.2004 19:17

ja hijackthis findet nicht viel, dafür Escan umso mehr. ich lass es gerade durchlaufen und poste es dann hier
Moritz

Moer	11.12.2004 20:39

Hier ist der Hauptteil vom Log. Der Rest kommt (aus
Platzgründen) gleich.
mo

File C:\WINDOWS\telnet.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent48.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msmsgsui.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent_install.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bhosave.dat infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\MSMSGSVC.exe infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\silent48[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\protector[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\bobby[1].exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\protector_update[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\24WEN45B\silent_install[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\bhosave.dat infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\telnet.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent48.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\msmsgsui.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\silent_install.exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.

cacatoa

11.12.2004 20:45

Sag mal, was machst Du da?
Im HJT-Logfile taucht gar nix von den Dateien auf, die eScan als infiziert zeigt; nix aus dem System32 Ordner z.B.
Hast Du das HJT Logfile im normalen Modus erstellt? Das mußt Du nämlich; sonst hilfts gar nix...

Moer	11.12.2004 21:12

Ja hab ich! finds auch komisch, dass er nichts erkennt???
Hier der rest des escans.
Hoffentlich kannst du irgendwas entdecken/bzw mir empfehlen zu tun!
Danke für die Hilfe!!!

File C:\WINDOWS\System32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken:.No Action Taken.
File C:\WINDOWS\System32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\bhosave.dat infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM\MSMSGSVC.exe infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\silent48[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.j" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\protector[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\bobby[1].exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\protector_update[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\24WEN45B\silent_install[1].exe infected by "not-a-virus:AdWare.ToolBar.EliteBar.q" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: No Action Taken.

cacatoa

11.12.2004 21:17

Also, ich kapier´s nicht. Jetzt mach mal folgendes:
Du hast ja einen Ordner C:\bases für den eScan erstellt.
Den leerst du jetzt. Lasse den Ordner bestehen!!
Lade Dir diesen eScan (mwav.exe) runter; entpacke die Datei in den Ordner C:\bases. Update (kavupd.exe) und lasse den eScan im abgesicherten Modus laufen (mwavscan.com). Mache alle Häkchen, vor allem "scan all local drives".
Dies ist eine alte eScan version, die die Malware auch löscht.
Dann neuen Bericht von escan (mwavlog).
Bis dann
cacatoa

Moer	11.12.2004 22:00

Danke meld mich morgen wieder
Schönen Abend
Moritz

Moer	12.12.2004 14:41

Irgendwie lässt sich der scan nicht ausführern. Escan empfiehlt eine neuere Version downzuloaden und startet nicht??
Wie kann ich das umgehen?

cacatoa

12.12.2004 16:43

Mach doch einfach das, was ich Dir geschrieben habe. Genau lesen! (entpacke die Datei)

Moer	13.12.2004 12:33

Ok. Hier das neue Escan Log:

File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\silent48[1].exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.j. No Action Taken.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\79SETTHI\protector[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\bobby[1].exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YQ4H1I86\protector_update[1].exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\24WEN45B\silent_install[1].exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.q. No Action Taken.
File C:\WINDOWS\SYSTEM32\notepad.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\wintii32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\bkmsf32.dat infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\wintxa32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\winnne32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\winjei32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\wintru32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\windfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\winunu32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\wincoz32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\windns32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\wintft32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\doolsav.dat tagged as not-a-virus:AdWare.EliteBar. No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvhin32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\kalvbjd32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\bhosave.dat tagged as not-a-virus:AdWare.ToolBar.EliteBar.q. No Action Taken.
File C:\WINDOWS\SYSTEM32\kalvdcm32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\winmm64.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\kalvcop32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\kalvyfj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\kalvvaj32.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSTEM32\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: File Deleted.
File C:\WINDOWS\telnet.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\WINDOWS\silent48.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.j. No Action Taken.
File C:\WINDOWS\dpe.dll infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\WINDOWS\msmsgsui.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\WINDOWS\SYSCOM.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: File Deleted.
File C:\WINDOWS\remove_me.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: File Deleted.
File C:\WINDOWS\silent_install.exe tagged as not-a-virus:AdWare.ToolBar.EliteBar.q. No Action Taken.
File C:\Q8276112.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\RECYCLED\Q330995.exe infected by "Trojan.Win32.Small.bb" Virus. Action Taken: File Deleted.
File C:\prot.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\FOUND.011\FILE0034.CHK infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\FOUND.012\FILE0000.CHK infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\FOUND.014\FILE0000.CHK infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\FOUND.018\FILE0015.CHK tagged as not-a-virus:AdWare.ToolBar.EliteBar.q. No Action Taken.
File C:\ied_s7m.cab infected by "Trojan-Downloader.Win32.Mediket.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094840.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.n. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094841.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.k. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094842.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.k. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094843.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.m. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094844.dll tagged as not-a-virus:AdWare.ToolBar.EliteBar.q. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094852.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094853.exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094854.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094864.exe infected by "TrojanDownloader.Win32.Small.sg" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094865.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094867.dll tagged as not-a-virus:AdWare.EliteBar. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094871.DLL infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP81\A0094884.dll tagged as not-a-virus:AdWare.EliteBar. No Action Taken.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097492.exe infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097495.com infected by "TrojanDropper.Win32.Small.lx" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097496.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097497.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097498.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097499.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097500.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097501.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097502.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097503.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097504.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097505.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097506.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.

Moer	13.12.2004 12:34

und der 2.teil

File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097507.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097508.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097509.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097510.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097511.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097512.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097513.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097514.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097517.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097519.dll infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097520.exe infected by "Trojan.Win32.StartPage.lj" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097521.dll infected by "TrojanDownloader.Win32.Small.zq" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097522.dll infected by "Trojan.Win32.StartPage.ld" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097529.exe infected by "Trojan.Win32.StartPage.ht" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097530.exe infected by "Trojan.Win32.Small.bb" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{502F088A-BAD0-4436-B496-08B0C33443C7}\RP82\A0097531.exe infected by "Trojan.Win32.StartPage.nk" Virus. Action Taken: File Deleted.

Moer	13.12.2004 12:48

Ich habe nun rausgefunden was es mit dieser lsass.exe Datei auf sich hat.
Allerdings hat es bei mir nicht funktioniert??vielleicht habe ich etwas falschgemacht?
Hier die Infos:

"Falls Windows wieder automatisch runterfährt, hat man den Sasser Virus. Man kann das unterbrechen indem man: Start – Ausführen und dann "shutdown -a" eingibt. Ein Remove-Tool gibt es auch. Siehe auch: Link

http://www.microsoft.com/downloads/d...displaylang=de

Erstmal ist lsass.exe eine Systemdatei.
Bei einer lssas.exe [/SIZE] siehts jedoch schon wieder anders aus.

Der lokale Sicherheitsdienst lsass.exe (Local Security Authority Subsystem) steuert die Richtlinien für User. Wenn Sie nicht als Administrator angemeldet sind, und nur auf bestimmte Dateien zugriff haben, ist die lsass.exe dafür verantwortlich. Versuchen Sie sich mit einem falschen Usernamen anzumelden, wird die lsass.exe dieses feststellen und den Zugriff auf das Betriebssystem verhindern.

Sieg über W32.MSBlaster C – Wurm
"lssas.exe"

Neustart, F8 und nach Vorgabe in den abgesicherten Modus mit Eingabeaufforderung.
Dann in den Administrator. Das funktionierte.
Und nun die DOS-Befehle (hier gibt es keine Maus zum Klicken).

Erst mal mit cd.. solange bis nur noch C:\ da steht
und dann gings los:
C:\cd windows
C:\windows>cd system32
C:\windows>system32>dir (für Direktory, um den genauen File-Namen zu haben)
C:\windows>system32>del lssas.exe [return]
C:\windows>system32>dir (zur Kontrolle) und weg war er.

Ich hatte ihn Getötet! Die Moral: Es ist nie was zu alt, dass es doch noch zu was nützt.

Ich hoffe ich konnt dir helfen!Bitte schreib, ob es

Falls es Blaster ist, den neusten Stinger drüber und gut ist es!
LG, Charlie

Für die „Nichtmausschubser“, dass mit DOS geht auch ganz gut, habe es gerade getestet!?

@ Snake26, warum so umständlich ins DOS zu kommen? einfach Ausführung/cmd und enter!"

Moritz: Es gibt auch ein Extra Removal Toll für Sasser. Allerdings müsste man dann Windows update machen. Deren beschreibung hat bei mir auch nicht geklappt.
ich frage mich ob es auch ohne dieses Update ginge??

Hier die Info:
Before you begin:
If you are running Windows 2000 or XP, and have not yet done so, you must patch for the vulnerability described in Microsoft Security Bulletin MS04-011. If you do not, it is likely that your computer will continue to be reinfected.

What to do if the computer shuts down before you can patch or get the tool
This threat can cause Windows to keep shutting down and restarting. This can prevent you from installing the Microsoft patch or downloading the tool described below.
________________________________________
Notes:
• You may have to try this several times, as you only have about 20 seconds to do steps 3 to 6.
• This will not work on Windows 2000.
________________________________________

To prevent the shut down, do the following:
1. Disconnect the computer from the network/Internet connection. (Disconnect the cable if necessary.)
2. Restart the computer.
3. As soon as Windows opens and you see the Windows desktop, click Start > Run.
4. Type:

cmd

and press Enter.
5. Type:

shutdown -i

and press Enter.
6. In the Remote Shutdown Dialog that opens, do the following:
a. Click Add, type your computer name into the Add Computers dialog box, and then click OK.
b. In the "Display warning for" field, type 9999.
c. Type the following text in the Comment box:

Delay Lsass.exe shutdown.
d. Click OK.
7. Reconnect the network/Internet connection.
8. Connect to the Internet, and get the patch. Then continue with the steps described below.

When you have patched your computer and removed the threat, you can re-enable the 20 second default warning if you wish.

Removal using the W32.Sasser Removal Tool
Symantec Security Response has developed a removal tool to clean the infections of W32.Sasser.Worm. Use this tool first, as it is the easiest way to remove this threat.

Manual Removal
The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.
1. End the malicious process (Windows NT/2000/XP).
2. Disable System Restore (Windows XP).
3. Update the virus definitions.
4. Run a full system scan and delete all the files detected as W32.Sasser.Worm.
5. Reverse the change made to the registry.
For details on each of these steps, read the following instructions.

1. To end the malicious process
On Windows NT/2000/XP computers, you must first end the malicious process. Follow these instructions:
a. Press Ctrl+Alt+Delete once.
b. Click Task Manager.
c. Click the Processes tab.
d. Double-click the Image Name column header to alphabetically sort the processes.
e. Scroll through the list and look for the following processes:
• avserve.exe
• any process with a name consisting of four or five digits, followed by _up.exe (for example, 74354_up.exe).
f. If you find any such process, click it, and then click End Process.
g. Exit the Task Manager.
2. To disable System Restore (Windows XP)
If you are running Windows XP, we recommend that you temporarily turn off System Restore. Windows XP uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

For instructions on how to turn off System Restore, read your Windows documentation, or "How to turn off or turn on Windows XP System Restore"
________________________________________
Note: When you are completely finished with the removal procedure and are satisfied that the threat has been removed, re-enable System Restore by following the instructions in the aforementioned documents.
________________________________________
3. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for quality assurance before they are posted to our servers. There are two ways to obtain the most recent virus definitions:
• Running LiveUpdate, which is the easiest way to obtain virus definitions: These virus definitions are posted to the LiveUpdate servers once each week (usually on Wednesdays), unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, refer to the Virus Definitions (LiveUpdate).
• Downloading the definitions using the Intelligent Updater: The Intelligent Updater virus definitions are posted on U.S. business days (Monday through Friday). You should download the definitions from the Symantec Security Response Web site and manually install them. To determine whether definitions for this threat are available by the Intelligent Updater, refer to the Virus Definitions (Intelligent Updater).

The Intelligent Updater virus definitions are available: Read "How to update virus definition files using the Intelligent Updater" for detailed instructions.

4. To scan for and delete the infected files
a. Start your Symantec antivirus program and make sure that it is configured to scan all the files.
• For Norton AntiVirus consumer products: Read the document, "How to configure Norton AntiVirus to scan all files."
• For Symantec AntiVirus Enterprise products: Read the document, "How to verify that a Symantec Corporate antivirus product is set to scan all files."
b. Run a full system scan.
c. If any files are detected as infected with W32.Sasser.Worm, click Delete.

5. To reverse the change made to the registry
________________________________________
WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.
________________________________________
a. Click Start, and then click Run. (The Run dialog box appears.)
b. Type regedit

Then click OK. (The Registry Editor opens.)
c. Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
d. In the right pane, delete the value:

"avserve.exe"="%Windir%\avserve.exe"
e. Exit the Registry Editor.

Revision History:
• May 26, 2004: Added link to document with information about LSASS related traffic.
• May 16, 2004. Updated Step 6 of "What to do if the computer shuts down before you can patch or get the tool" for clarity.
• May 12, 2004: Downgraded from Category 3 to Category 2 based on decreased rate of submissions.
• May 3, 2004:
• Updated alias information.
• Added Symantec Product Information.
• May 1, 2004:
• Upgraded to Category 3, based on an increased submission rate.
• Included link to removal tool.

Moer	13.12.2004 15:25

ich glaube habe problem mit windows update und sasser removal tool gelöst.
danke

Alle Zeitangaben in WEZ +1. Es ist jetzt 08:39 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131