|
swizzor.gf ich hab ein problem mit dem oben genannten trojaner. ich lösche ihn immer wieder mit antivir aber er kommt dauernd wieder. hier mal die hijackthis logfile Logfile of HijackThis v1.99.1 Scan saved at 13:40:06, on 24.09.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE C:\Programme\Logitech\MouseWare\system\em_exec.exe E:\...\pcsuite\NOKIAP~1\TRAYAP~1.EXE C:\WINDOWS\System32\ctfmon.exe C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE E:\...\Spybot - Search & Destroy\TeaTimer.exe C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\svchost.exe E:\Firefox\firefox.exe C:\Dokumente und Einstellungen\...\Desktop\...\Neuer Ordner\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\michi\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [SpybotSnD] "E:\...\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [CloneCDTray] "E:\...\clonecd\CloneCDTray.exe" /s O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\...\pcsuite\NOKIAP~1\TRAYAP~1.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\...\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Download Flash with Flash Capture - E:\...\Flash Capture\dl.htm O8 - Extra context menu item: Download with GetRight - E:\...\GetRight\GRdownload.htm O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open with GetRight Browser - E:\...\GetRight\GRbrowse.htm O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://host.cycore.net/plugins/windows/ie/Cult3D_IE_5.3.0.228.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122027214281 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\PROGRAMME\AVPERSONAL\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE hoffe ihr könnt mir helfen _____________ Anm. Aktive Links editiert! Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis. LG Cidre S-Mod TB |
Hallo, kann ausser das SP2 fehlt nichts negatives an deinem Log erkennen. Wo(genauer Pfad) findet Antivir den Trojaner? Grüße Wildone |
C:\DOKUME~1\GESCHF~1\LOKALE~1\TEMP\3AB7CF.EXE Ist das Trojanische Pferd TR/Swizzor.GF |
Hallo, Scanne dein System mal mit Escan (Anleitung genau lesen!) und poste das Ergebnis wie beschrieben. Grüße Wildone |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({39fda070-61ba-11d2-ad84-00105a17b608})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({a1eedaa7-c4d8-11d2-ad9c-00105a17b608})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ca4fc24b-c65c-11d1-aa6f-000000000000})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({ddd136ce-517b-11d2-ad03-00105a17b608})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({4f99a075-5227-11d2-ad06-00105a17b608})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({371d0743-7a57-11d2-ad5a-00105a17b608})! Action taken: No Action Taken. Mon Sep 26 15:44:24 2005 => System found infected with SpywareNo!/SpySheriff Commercial KeyLogger ({e9d55102-9683-11d2-ba68-0040053687fe})! Action taken: No Action Taken. Mon Sep 26 15:47:04 2005 => System found infected with Conducent FlexPak Spyware/Adware (gpinstall.exe)! Action taken: No Action Taken. Mon Sep 26 15:47:07 2005 => System found infected with Free Scratch and Win Spyware/Adware (updater.exe)! Action taken: No Action Taken. Mon Sep 26 15:47:13 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken. Mon Sep 26 15:47:17 2005 => System found infected with WhenU.SaveNow Spyware/Adware (cmdlineext02.dll)! Action taken: No Action Taken. Mon Sep 26 15:48:15 2005 => File C:\data infected by "Trojan-Downloader.Win32.IstBar.kc" Virus! Action Taken: No Action Taken. Mon Sep 26 15:49:33 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\Window clock move.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus! Action Taken: No Action Taken. Mon Sep 26 15:50:57 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\mpeg size amok\Else locks.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus! Action Taken: No Action Taken. Mon Sep 26 15:54:50 2005 => File C:\Dokumente und Einstellungen\Geschäft\Desktop\Michi\Neuer Ordner\backups\backup-20050506-193613-993.dll infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus! Action Taken: No Action Taken. Mon Sep 26 16:08:53 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0D85E745\adv620[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:08:58 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\0D85E745\open[1].exe infected by "Trojan-Downloader.Win32.Small.ald" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:01 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\adv157[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:02 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\dia148[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:03 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BG6ATMVF\newexpl[2].php infected by "Exploit.VBS.Phel.i" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:08 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GDGBGN8N\dir4523455[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:14 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\IPGJMD65\sploit[1].anr infected by "Trojan-Downloader.Win32.Ani.c" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:15 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\adv156[1].php infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:16 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\enter[1].htm infected by "Trojan-Downloader.JS.Psyme.ap" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:17 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\tool[1].txt infected by "Trojan-Downloader.Win32.Small.aqt" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:18 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\JQ1FKB7S\upAYB[1].int infected by "Trojan-Downloader.Win32.Swizzor.dj" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:23 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\prompt[1].php infected by "Trojan-Downloader.JS.IstBar.b" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:23 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\prompt[2].php infected by "Trojan-Downloader.JS.IstBar.j" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:24 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NQ6GI87W\tool1[1].txt infected by "Trojan.Win32.LowZones.y" Virus! Action Taken: No Action Taken. Mon Sep 26 16:09:31 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temporary Internet Files\Content.IE5\QFYNEHAF\wow[1].htm infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken. Mon Sep 26 16:14:08 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.* Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1126E93.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\11A9CD7.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\11E6ABC.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1217B7E.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1257C57.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\12C6FAA.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\13387E.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\13D88DC.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1459A05.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\14A498.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\157CA16.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\19EDB62.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1A1A9B3.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1B4403A.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1E9D1B2.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\1FF2E08.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\230A194.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\27B8D97.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2838C52.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2A835F.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2D5574.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\31DF.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\32DBA9.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\350D36.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\36D532.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\383178.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\3873A0.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\3C04A5.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\410174.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\431DA5.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\496BED.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\50C4CD.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\50C9EC.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5A04D5.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5D5CBD.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5D61C4.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\5FB335.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\617C7D.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\644E1A.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\65F616.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\668145.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\6D1555.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\7514A5.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\79A005.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\7C19ED.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\88EE40.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\8AEA46.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\8BAF75.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\94F04.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\9BD6BF.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\9BD9F7.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\A3AC2E.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\A97897.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\ADD8DA.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\BD1484.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\C7EE47.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\C88157.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\D38EB6.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\D49C2F.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\E2255F.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\EABA4F.EXE.VIR [**] Mon Sep 26 16:14:08 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\F04976.EXE.VIR [**] Mon Sep 26 16:58:48 2005 => Total Disinfected Files: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Mon Sep 26 15:48:30 2005 => File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DALE PLUS RULE INSIDE\dateeach.exe tagged as "not-a-virus:AdWare.Lop.o". Action Taken: No Action Taken. Mon Sep 26 15:49:33 2005 => File C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\ppotjgmp.exe tagged as "not-a-virus:AdWare.Lop.o". Action Taken: No Action Taken. Mon Sep 26 16:07:07 2005 => File C:\Dokumente und Einstellungen\Geschäft\Lokale Einstellungen\Temp\updater_temp_Walkover Mapeditor\rollback\michi\mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. Mon Sep 26 16:09:51 2005 => File C:\Program Files\mIRC\backup\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. Mon Sep 26 16:09:53 2005 => File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. Mon Sep 26 16:32:58 2005 => File C:\WINDOWS\NDNuninstall6_38.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken. Mon Sep 26 16:54:30 2005 => File E:\michi\mirc\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Mon Sep 26 15:45:13 2005 => Offending Folder found: C:\WINDOWS\System32\msview Mon Sep 26 15:45:14 2005 => Offending Folder found: C:\PROGRA~1\myway Mon Sep 26 15:47:04 2005 => Offending file found: C:\WINDOWS\gpinstall.exe Mon Sep 26 15:47:07 2005 => Offending file found: C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\updater.exe Mon Sep 26 15:47:13 2005 => Offending file found: C:\WINDOWS\iun6002.exe Mon Sep 26 15:47:17 2005 => Offending file found: C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\cmdlineext02.dll Mon Sep 26 16:58:48 2005 => Total Virus(es) Found: 42 Mon Sep 26 16:58:48 2005 => Total Errors: 681 Mon Sep 26 16:58:48 2005 => Time Elapsed: 01:16:10 Mon Sep 26 16:58:48 2005 => Total Objects Scanned: 103826 Mon Sep 26 15:41:55 2005 => Virus Database Date: 2005/09/09 Mon Sep 26 16:58:48 2005 => Virus Database Date: 2005/09/09 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ |
Hallo, also, lösche erstmal im IE unter Extras>>Internetoptionen deine temporären Internetdateien. Dann lösche mal den Inhalt des Quarantäneordners von AntiVir. Dann schau mal ob du unter Systemsteuerung>>Software solche Einträge findest: Conducent FlexPak Free Scratch and Win zipitpro WhenU.SaveNow AyWay wenn ja deinstallieren. Dann besorgst du dir Killbox und gibst du nacheinander folgende Dateien ein, und bestägst erst nach der letzten den Neustart: C:\data C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\Window clock move.exe C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\mpeg size amok\Else locks.exe C:\Dokumente und Einstellungen\Geschäft\Desktop\Michi\Neuer Ordner\backups\backup-20050506-193613-993.dll C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DALE PLUS RULE INSIDE\dateeach.exe C:\Dokumente und Einstellungen\Geschäft\Anwendungsdaten\Comp tray settings\ppotjgmp.exe C:\WINDOWS\NDNuninstall6_38.exe C:\WINDOWS\gpinstall.exe C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\updater.exe C:\WINDOWS\iun6002.exe C:\DOKUME~1\GESCHF~1\LOKALE~1\Temp\cmdlineext02.dll + die Ordner C:\WINDOWS\System32\msview C:\PROGRA~1\myway Dann scannst du mal folgendem Tool dein System. Dann löschst du die im Ordner C:\Bases_X die MWAV.LOG, führst die kavupd.exe aus, und scannst danach wieder mit Escan im abgesicherten Modus, und postest das neue Log +den Inhalt der C:\smitfiles.txt Grüße Wildone |
Zitat:
und die programme die du genannt hast die unter software sein solllten sind nicht da. |
Hallo, das mit dem Tool habe ich etwas dürftig beschrieben, du mußt die Runthis.bat ausführen. Dann später die C:\smitfiles.txt posten. Das unter Systemsteuerung>>Software keine derartigen Einträge sind, ist zwar schade aber dann muss man das halt manuell vornehmen, das sieht man dann beim nächsten Escan Logfile. Grüße Wildone |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 07:58 Uhr. |
Copyright ©2000-2025, Trojaner-Board