|
Trojaners Smitfraud.c aka Troj/FakeAle-c (cidre help me) Hier der HJT log Logfile of HijackThis v1.99.1 Scan saved at 17:19:49, on 16.06.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\System32\svchost.exe H:\WINDOWS\system32\spoolsv.exe H:\Programme\Alwil Software\Avast4\aswUpdSv.exe H:\Programme\Alwil Software\Avast4\ashServ.exe H:\WINDOWS\system32\nvsvc32.exe H:\Programme\Alwil Software\Avast4\ashMaiSv.exe H:\Programme\Alwil Software\Avast4\ashWebSv.exe H:\WINDOWS\system32\wuauclt.exe H:\WINDOWS\system32\taskmgr.exe H:\WINDOWS\system32\wscntfy.exe P:\stuff\hijackthis\HijackThis.exe O3 - Toolbar: News Ticker - {05F8C4F5-7CCF-4129-B221-B2B4CFC589DA} - H:\Programme\NewsTicker\Ticker.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Mirabilis ICQ] H:\PROGRA~1\ICQ\ICQNet.exe O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DU Meter] H:\Programme\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "H:\Programme\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] H:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] H:\Programme\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] H:\Programme\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [Daily Weather Forecast] H:\Programme\Daily Weather Forecast\weather.exe O4 - HKLM\..\Run: [RefreshLock] H:\Programme\refreshlock\RefreshLock.exe O4 - HKLM\..\Run: [TkBellExe] "H:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [PSGuard] H:\Programme\PSGuard\PSGuard.exe O4 - HKLM\..\RunOnce: [Ad-aware] "H:\Programme\Lavasoft\Ad-aware 6\Ad-aware.exe" "+b1" O4 - HKCU\..\Run: [MSMSGS] "H:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Steam] "h:\programme\valve\steam\steam.exe" -silent O4 - Startup: Ruhezeiten vorziehen.bat O4 - Startup: WetterStation².lnk = ? O8 - Extra context menu item: &Suche im Duden - res://H:\Programme\Duden-Suche Toolbar\toolbar.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - H:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - H:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Guru News Reader - {9025F70D-DB4B-4312-982B-8FE916987ED8} - H:\Programme\NewsTicker\Ticker.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programme\Messenger\msmsgs.exe O16 - DPF: {54C75FB0-6B8B-4278-BF7B-77036F15A69E} - http://akamai.downloadv3.com/binarie...1041_EN_XP.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - H:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - H:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - H:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - H:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - H:\Programme\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - H:\Programme\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe und hier der eScan log, hoffe ihr könnt mir helfen :( Thu Jun 16 18:16:00 2005 => ***** Scanning Registry and File system for Adware/Spyware ***** Thu Jun 16 18:16:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({4eb7bbe8-2e15-424b-9ddb-2cdb9516b2c3})! Action taken: No Action Taken. Thu Jun 16 18:16:01 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:01 2005 => System found infected with Bargain Buddy Spyware/Adware ({c6906a23-4717-4e1f-b6fd-f06ebed15678})! Action taken: No Action Taken. Thu Jun 16 18:16:01 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:02 2005 => System found infected with Bargain Buddy Spyware/Adware ({8eee58d5-130e-4cbd-9c83-35a0564e5678})! Action taken: No Action Taken. Thu Jun 16 18:16:02 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:02 2005 => System found infected with Bargain Buddy Spyware/Adware ({f4e04583-354e-4076-be7d-ed6a80fd66da})! Action taken: No Action Taken. Thu Jun 16 18:16:02 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:03 2005 => Offending Folder H:\PROGRA~1\sidefind present... Thu Jun 16 18:16:03 2005 => Object "sidefind Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:04 2005 => Offending Folder H:\PROGRA~1\istsvc present... Thu Jun 16 18:16:04 2005 => Object "istbar Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:04 2005 => Offending value found in HKLM\Software\powerscan !!! Thu Jun 16 18:16:04 2005 => Object "powerscan Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:04 2005 => Offending Folder H:\PROGRA~1\BULLSE~1 present... Thu Jun 16 18:16:04 2005 => Object "BullsEye Network Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:04 2005 => Offending value found in HKLM\Software\microsoft\downloadmanager !!! Thu Jun 16 18:16:04 2005 => Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:05 2005 => System found infected with eZula Spyware/Adware (exclean.exe)! Action taken: No Action Taken. Thu Jun 16 18:16:05 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken. Thu Jun 16 18:16:07 2005 => ***** Scanning Registry for errors created because of Adware/Spyware ***** Thu Jun 16 18:16:08 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "H:\WINDOWS\eg_auth_1041.dll". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\BDA.cab". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\BDANT.cab". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\BDAXP.cab". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\DSETUP.dll". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\DirectX.cab". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\ManagedDX.CAB". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\dsetup32.dll". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\dxnt.cab". Action Taken: No Action Taken. Thu Jun 16 18:16:09 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\DOKUME~1\Ersch\LOKALE~1\Temp\{256F319A-AEA5-481F-829A-2CEF51A91FDA}\{8421F058-CB2D-4BCE-B487-4A559DE70173}\DirectX9\dxsetup.exe". Action Taken: No Action Taken. Thu Jun 16 18:16:10 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "H:\WINDOWS\eg_auth_1041.dll". Action Taken: No Action Taken. Thu Jun 16 18:16:27 2005 => Entry "HKCR\CLSID\{F4E04583-354E-4076-BE7D-ED6A80FD66DA}" refers to invalid object "H:\WINDOWS\system32\msbe.dll". Action Taken: No Action Taken. Thu Jun 16 18:16:31 2005 => Entry "HKCR\AcroIEHelper.AcroIEHlprObj" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken. Thu Jun 16 18:16:31 2005 => Entry "HKCR\AcroIEHelper.AcroIEHlprObj.1" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken. Thu Jun 16 18:16:37 2005 => Entry "HKCR\IEFlash.IEFlash" refers to invalid object "{E5A1691B-D188-4419-AD02-90002030B8EE}". Action Taken: No Action Taken. Thu Jun 16 18:20:01 2005 => Checking for Welchia Virus... Thu Jun 16 18:20:02 2005 => Checking for LovGate Virus... Thu Jun 16 18:20:02 2005 => Checking for CodeRed Virus... Thu Jun 16 18:20:02 2005 => Checking for OpaServ Virus... Thu Jun 16 18:20:02 2005 => Checking for Sobig.e Virus... Thu Jun 16 18:20:03 2005 => Checking for Winupie Virus... Thu Jun 16 18:20:03 2005 => Checking for Swen Virus... Thu Jun 16 18:20:03 2005 => Checking for JS.Fortnight Virus... Thu Jun 16 18:20:03 2005 => Checking for Novarg Virus... Thu Jun 16 18:20:03 2005 => Checking for Pagabot Virus... Thu Jun 16 18:20:04 2005 => Checking for Parite.b Virus... Thu Jun 16 18:20:04 2005 => Checking for Parite.a Virus... Thu Jun 16 18:20:04 2005 => Checking for Adware.SeekSeek Virus... Thu Jun 16 18:20:04 2005 => ***** Scanning complete. ***** Thu Jun 16 18:20:04 2005 => Total Objects Scanned: 10194 Thu Jun 16 18:20:04 2005 => Total Virus(es) Found: 14 Thu Jun 16 18:20:05 2005 => Total Disinfected Files: 0 Thu Jun 16 18:20:05 2005 => Total Files Renamed: 0 Thu Jun 16 18:20:05 2005 => Total Deleted Objects: 0 Thu Jun 16 18:20:05 2005 => Total Errors: 17 Thu Jun 16 18:20:05 2005 => Time Elapsed: 00:05:46 Thu Jun 16 18:20:05 2005 => Virus Database Date: 2005/06/13 Thu Jun 16 18:20:06 2005 => Virus Database Count: 134428 Thu Jun 16 18:20:06 2005 => Scan Completed. wie bekomm ich die gefunden viren wech ? also eScan möcht ich nicht unbedingt kaufen :( um das entfernen zu können :( |
Hallo veet, zum einen hast du eScan falsch ausgeführt und zum anderen steht in der Anleitung genau beschrieben, daß du eScan nicht käuflich erwerben mußt, sondern die Malware Dateien mit Alternativ Tools löschen kannst. eScan ist Dank seiner hohen Erkennungsrate leider nur noch für eine vernünftige Analyse zu gebrauchen und deshalb unersetzlich. Führe einen erneuten Scan aus, diesmal richtig und die Anleitung lesen, und poste die Virus Log Information, lösche aber zuvor die mwav.log. |
@ veet Wenn du tatsächlich meinen Thread abgearbeitet hast und noch zu keiner Lösung gekommen bist, lies mal diesen Thread, poste aber zunächst die korrekten Escan Ergebnisse: http://www.trojaner-board.de/showthread.php?t=18970 |
ok hab alles nochmal gescannt, so sieht es nun bei mir aus :( Logfile of HijackThis v1.99.1 Scan saved at 10:09:54, on 18.06.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\Explorer.EXE P:\stuff\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O3 - Toolbar: News Ticker - {05F8C4F5-7CCF-4129-B221-B2B4CFC589DA} - H:\Programme\NewsTicker\Ticker.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Mirabilis ICQ] H:\PROGRA~1\ICQ\ICQNet.exe O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DU Meter] H:\Programme\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "H:\Programme\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] H:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] H:\Programme\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] H:\Programme\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [Daily Weather Forecast] H:\Programme\Daily Weather Forecast\weather.exe O4 - HKLM\..\Run: [RefreshLock] H:\Programme\refreshlock\RefreshLock.exe O4 - HKLM\..\Run: [TkBellExe] "H:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE H:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\RunOnce: [Ad-aware] "H:\Programme\Lavasoft\Ad-aware 6\Ad-aware.exe" "+b1" O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - H:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - H:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Guru News Reader - {9025F70D-DB4B-4312-982B-8FE916987ED8} - H:\Programme\NewsTicker\Ticker.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programme\Messenger\msmsgs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - H:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - H:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - H:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - H:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\glaub mich tritt ein Pferd\hacktools\nvsvc32.exe" /service (file missing) O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - H:\Programme\SiSoftware\SiSoftware Sandra Lite 2005\RpcDataSrv.exe O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - H:\Programme\SiSoftware\SiSoftware Sandra Lite 2005\RpcSandraSrv.exe hier die eScan_neu ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 18 10:38:05 2005 => System found infected with Bargain Buddy Spyware/Adware ({4eb7bbe8-2e15-424b-9ddb-2cdb9516b2c3})! Action taken: No Action Taken. Sat Jun 18 10:38:05 2005 => System found infected with Bargain Buddy Spyware/Adware ({c6906a23-4717-4e1f-b6fd-f06ebed15678})! Action taken: No Action Taken. Sat Jun 18 10:38:05 2005 => System found infected with Bargain Buddy Spyware/Adware ({8eee58d5-130e-4cbd-9c83-35a0564e5678})! Action taken: No Action Taken. Sat Jun 18 10:38:05 2005 => System found infected with Bargain Buddy Spyware/Adware ({f4e04583-354e-4076-be7d-ed6a80fd66da})! Action taken: No Action Taken. Sat Jun 18 10:38:24 2005 => System found infected with eZula Spyware/Adware (exclean.exe)! Action taken: No Action Taken. Sat Jun 18 10:39:11 2005 => File H:\WINDOWS\uninstIU.exe infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken. Sat Jun 18 10:39:17 2005 => File H:\WINDOWS\p2esocks_1041.dll infected by "Trojan.Win32.P2E.bt" Virus! Action Taken: No Action Taken. Sat Jun 18 11:12:12 2005 => File D:\System Volume Information\_restore{AF9EA7D1-C8D6-4EC4-8936-AD95973B7274}\RP14\A0004454.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:19:12 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP47\A0067061.rbf infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:19:19 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP47\A0067130.rbf infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:19:50 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP48\A0067335.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:19:50 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP48\A0067337.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:21:22 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP50\A0074698.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:21:23 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP50\A0074707.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:21:49 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP52\A0078776.exe infected by "Trojan-Downloader.Win32.IstBar.gm" Virus! Action Taken: No Action Taken. Sat Jun 18 11:22:02 2005 => File D:\System Volume Information\_restore{E4CB43AB-CE11-4100-BBBE-361548E290DF}\RP31\A0027544.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:22:03 2005 => File D:\System Volume Information\_restore{E4CB43AB-CE11-4100-BBBE-361548E290DF}\RP31\A0027556.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. Sat Jun 18 11:22:03 2005 => File D:\System Volume Information\_restore{E4CB43AB-CE11-4100-BBBE-361548E290DF}\RP31\A0027557.exe infected by "Virus.Win32.Parite.b" Virus! Action Taken: No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 18 10:42:06 2005 => File H:\WINDOWS\system32\KILLAPPS.EXE tagged as not-a-virus:Tool.Win32.KillApp.b. No Action Taken. Sat Jun 18 11:09:14 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd1.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 18 11:10:07 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd1426.dll tagged as "not-a-virus:AdWare.Altnet.a". Action Taken: No Action Taken. Sat Jun 18 11:10:07 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd1427.dll tagged as "not-a-virus:AdWare.Altnet.a". Action Taken: No Action Taken. Sat Jun 18 11:10:24 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 18 11:10:26 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd211.INT tagged as "not-a-virus:AdWare.Gator.4203". Action Taken: No Action Taken. Sat Jun 18 11:10:26 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd212.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:26 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd213.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:26 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd214.INT tagged as "not-a-virus:AdWare.Gator.5017". Action Taken: No Action Taken. Sat Jun 18 11:10:27 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd215.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:27 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd216.INT tagged as "not-a-virus:AdWare.Gator.5017". Action Taken: No Action Taken. Sat Jun 18 11:10:27 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd217.INT tagged as "not-a-virus:AdWare.Gator.5017". Action Taken: No Action Taken. Sat Jun 18 11:10:27 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd218.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:28 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd222.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:28 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd223.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:28 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd224.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:29 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd225.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:29 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd226.INT tagged as "not-a-virus:AdWare.Gator.3124". Action Taken: No Action Taken. Sat Jun 18 11:10:29 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd227.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:29 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd228.INT tagged as "not-a-virus:AdWare.Gator.6041". Action Taken: No Action Taken. Sat Jun 18 11:10:30 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd229.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:30 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd230.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:30 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd231.INT tagged as "not-a-virus:AdWare.Gator.6051". Action Taken: No Action Taken. Sat Jun 18 11:10:30 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd232.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:31 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd233.INT tagged as "not-a-virus:AdWare.Gator.5115". Action Taken: No Action Taken. Sat Jun 18 11:10:39 2005 => File D:\RECYCLER\S-1-5-21-299502267-1425521274-839522115-1003\Dd3.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Sat Jun 18 11:12:08 2005 => File D:\sk8te\[sv]script2.61\[sv]script2.61\[sv]script2.61\[sv]script.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.03. No Action Taken. Sat Jun 18 11:14:05 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP45\A0058862.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.03. No Action Taken. Sat Jun 18 11:15:15 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP46\A0063138.exe tagged as "not-a-virus:AdWare.Altnet.l". Action Taken: No Action Taken. Sat Jun 18 11:15:58 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP47\A0065432.exe tagged as "not-a-virus:AdWare.Gator.4203". Action Taken: No Action Taken. Sat Jun 18 11:19:50 2005 => File D:\System Volume Information\_restore{B54E6343-DF5D-43C8-B780-10EDACD20EFF}\RP48\A0067336.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.16. No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Sat Jun 18 10:36:49 2005 => Virus Database Date: 2005/06/13 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ musste die eScan neu ein wenig SCHNEIDEN weil so viele sich im Ordner D:\System Volume Information\..... befinden ansonsten ist alles original, bitte helft mir :) |
Hallo, wechsel in den abgesicherten Modus bei deaktvierter Systemwiederherstellung (http://www.systemwiederherstellung-d...indows-xp.html) und fixe (Scan mit HJT, Häckchen vor Eintrag und auf fix checked klicken); R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing Lösche manuell: H:\WINDOWS\uninstIU.exe H:\WINDOWS\p2esocks_1041.dll Leere Deinen Papierkorb Neustart --> Systemwiederherstellung kann wieder aktiviert werden (durch die Deaktivierung werden sämtliche "System Volume Information\_restore" gelöscht). Bereinige Deine Registry mit Regseeker . Das Häckchen "Sichern vor Löschen" bitte setzen, wenn nicht vorhanden. dartus |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 14:44 Uhr. |
Copyright ©2000-2024, Trojaner-Board