Tr/Pakes.2 wieder einmal!
 

Hallo ich habe seit 2 tagen den Wurm Tr/Pakes.2 kriege ihn aber net weg .. bitte um Hilfe hier mein Hijack Log:

Logfile of HijackThis v1.99.1
Scan saved at 16:52:33, on 11.04.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programme\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Winamp\winampa.exe
C:\Programme\Creative\SBLive\Program\CTAvTray.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Zone Labs\ZoneAlarm\zonealarm.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\explorer.exe
C:\Programme\Winamp\Winamp.exe
C:\Dokumente und Einstellungen\Vincent\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://wer-mit-wem.webhop.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wer-mit-wem.webhop.net/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Programme\ICQ\NDetect.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Programme\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Programme\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [CTAvTray] C:\Programme\Creative\SBLive\Program\CTAvTray.EXE
O4 - HKLM\..\RunOnce: [CTAVTray] C:\Programme\Creative\SBLive\Program\CTAvStub.EXE EAX.AVI
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Programme\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe
O9 - Extra button: Klicke hier um das Projekt xp-AntiSpy zu unterstützen - {EFAF3560-441D-46CF-A939-941EE47FF7C4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O9 - Extra 'Tools' menuitem: Unterstützung für xp-AntiSpy - {EFAF3560-441D-46CF-A939-941EE47FF7C4} - C:\Programme\xp-AntiSpy\sponsoring\sponsor.html (HKCU)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/62...ridge-c267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5AFDE07D-3317-44DF-A0CF-997313F695BE}: NameServer = 212.185.251.70,168.95.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{5AFDE07D-3317-44DF-A0CF-997313F695BE}: NameServer = 212.185.251.70,168.95.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{5AFDE07D-3317-44DF-A0CF-997313F695BE}: NameServer = 212.185.251.70,168.95.1.1
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Dankeschön!

Hallo sidobushidofan,

führe bitte dies mal aus:
1. Downloade Dir escan und befolge genau diese Anleitung (Ordner „C:\base“ erstellen, die „mwav.exe“ dorthin entpacken, mit „kavupd.exe“ updaten. Scan IM ABGESICHERTEN MODUS dauert etwa eine Stunde),http://www.systemwiederherstellung-d...indows-xp.html
2. starte nach dem Scan wieder in den normalen Modus dauert,
3. öffne die Datei "mwav.log", klicke auf "bearbeiten" danach auf "suchen"
4. gebe dann "infected" ein,
5. suche weiter bei Treffern, markiere diese und kopiere sie ins Forum,
6. neben den Treffern auch das Gesamtergebnis (befindet sich ganz unter im Logfile) posten.

Beispiel:
Wed Feb 02 19:48:56 2005 => Total Files Scanned:
Wed Feb 02 19:48:56 2005 => Total Virus(es) Found:
.
.
.
.


dartus

Ok habe alles gemacht hier sind die Treffer :

=> File C:\WINDOWS\System32\o infected by "Trojan-Downloader.BAT.Ftp.c" Virus. Action Taken: No Action Taken.
=> File C:\DOKUME~1\Vincent\LOKALE~1\TEMPOR~1\Content.IE5\1TOJ50J8\bridge-c267[1].cab infected by "not-a-virus:AdWare.WinAD.ah" Virus. Action Taken: No Action Taken.
=> File C:\DOKUME~1\Vincent\LOKALE~1\TEMPOR~1\Content.IE5\EFM83V5O\a579a97a[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus. Action Taken: No Action Taken.
=> File C:\Dokumente und Einstellungen\Vincent\Lokale Einstellungen\Temporary Internet Files\Content.IE5\1TOJ50J8\bridge-c267[1].cab infected by "not-a-virus:AdWare.WinAD.ah" Virus. Action Taken: No Action Taken.
=> File C:\Dokumente und Einstellungen\Vincent\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EFM83V5O\a579a97a[1].js infected by "Trojan-Downloader.JS.Small.aq" Virus. Action Taken: No Action Taken.
=> Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*
=> Scanning File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR
=> File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR00
=> File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR01
=> File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR02
=> File C:\Programme\AVPersonal\INFECTED\MSAOL32.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Studio.VIR
=> File C:\Programme\AVPersonal\INFECTED\Studio.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Studio.VIR00
=> File C:\Programme\AVPersonal\INFECTED\Studio.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Studio.VIR01
=> File C:\Programme\AVPersonal\INFECTED\Studio.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Studio.VIR02
=> File C:\Programme\AVPersonal\INFECTED\Studio.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\SVKP.SYS.VIR
=> Scanning File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR
=> File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR00
=> File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR01
=> File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR02
=> File C:\Programme\AVPersonal\INFECTED\SystemReg166b.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR
=> File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR00
=> File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR01
=> File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> Scanning File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR02
=> File C:\Programme\AVPersonal\INFECTED\Winregs326a.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken.
=> File C:\WINDOWS\Downloaded Program Files\MediaAccX.dll infected by "not-a-virus:AdWare.WinAD.ah" Virus. Action Taken: No Action Taken.
=> File C:\WINDOWS\system32\o infected by "Trojan-Downloader.BAT.Ftp.c" Virus. Action Taken: No Action Taken.
=> File E:\System Volume Information\_restore{F35014AE-BDAA-4136-AD9B-30043E0FF327}\RP237\A0161027.COM infected by "Email-Worm.Win32.Sober.a" Virus. Action Taken: No Action Taken.


Tue Apr 12 16:07:49 2005 => ***** Scanning complete. *****

Tue Apr 12 16:07:49 2005 => Total Objects Scanned: 57618
Tue Apr 12 16:07:49 2005 => Total Virus(es) Found: 39
Tue Apr 12 16:07:49 2005 => Total Disinfected Files: 0

So das wars !

@sidobushidofan

Backdoor.Win32.Rbot.gen
http://www.sophos.de/virusinfo/analyses/w32rbotot.html

hier kann man dich nur raten dein system so schnell wie möglich neu aufzusetzen
formatC
hier eine anleitung
http://www.trojaner-board.de/showpos...28&postcount=2

sry
chaosman