|
Trojaner löschen Hab probleme mit Trojanern und kenn mich leider auch nicht so sehr mit Computern aus. Hab hier den Logfile: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\svchost.exe C:\Programme\Winamp\winampa.exe C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe C:\Programme\MSN Apps\Updater\01.02.3000.1001\de\msnappau.exe C:\Programme\Teamspeak2_RC2\TeamSpeak.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Andy.ANDREAS-3TGROK4\Eigene Dateien\antibadtrans.exe C:\Dokumente und Einstellungen\Andy.ANDREAS-3TGROK4\Eigene Dateien\hijackthis1982\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_p...ount_id=146265 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_p...ount_id=146265 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.g-wars.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_p...ount_id=146265 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.g-wars.de/ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll O2 - BHO: biObj Class - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file) O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programme\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.3000.1001\de\msntb.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.3000.1001\de\msntb.dll O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - (no file) O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxmk14247US O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download2.abetterinternet.com...6/payload2.cab O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/...9106/flash.cab O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.de/app/uploader/FileUploader.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab Hoffentlich kann mir wer helfen. Danke im vorraus! |
Poste bitte das komplette Logfile, bei dir fehlen die Systeminformationen (die 4 absätze am anfang des Logfiles) Das du dich nicht sehr gut mit Computern auskennst ist nicht so schlimm. 1. Kann man ja nicht alles wissen und 2. kann man aber ja immer was dazu lernen. |
Logfile of HijackThis v1.98.2 Scan saved at 01:04:55, on 18.10.2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\svchost.exe C:\Programme\Winamp\winampa.exe C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe C:\Programme\MSN Apps\Updater\01.02.3000.1001\de\msnappau.exe C:\Programme\Teamspeak2_RC2\TeamSpeak.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Andy.ANDREAS-3TGROK4\Eigene Dateien\antibadtrans.exe C:\Dokumente und Einstellungen\Andy.ANDREAS-3TGROK4\Eigene Dateien\hijackthis1982\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_p...ount_id=146265 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.couldnotfind.com/search_p...ount_id=146265 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.g-wars.de/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_p...ount_id=146265 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.g-wars.de/ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem219.dll O2 - BHO: biObj Class - {000006B1-19B5-414A-849F-2A3C64AE6939} - (no file) O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem302.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programme\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.3000.1001\de\msntb.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programme\MSN Apps\MSN Toolbar\01.02.3000.1001\de\msntb.dll O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - (no file) O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset WLAN Adapter\WLM.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearc...p=ZNxmk14247US O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download2.abetterinternet.com...6/payload2.cab O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/...9106/flash.cab O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} (ICQVideoControl Class) - http://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab30149.cab O16 - DPF: {8FA9D107-547B-4DBC-9D88-FABD891EDB0A} (shizmoo Class) - http://playroom.icq.com/odyssey_web11.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.de/app/uploader/FileUploader.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab So. Danke für die schnelle antwort! |
@ BigPluto lade den eScan (Anleitung beachten!) runter, erstelle dafür einen Ordner (=Verzeichnis) c:\bases, update den eScan online und führe ihn offline im abgesicherten Modus aus. Beachte bitte, dass der eScan ab Version 4.5.1 die gefundene Malware nicht löscht. "Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen" Teile uns das Ergebnis des eScan mit: welche Viren wurden auf Deinem Rechner gefunden. SD |
File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\biprep.exe infected by "not-a-virus:AdvWare.BiSpy.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl.exe infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe tagged as not-a-virus:RiskWare.PSWTool.EDialer. No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\Program Files\Common Files\Java\breg.cfg infected by "TrojanDownloader.Win32.RVP.e" Virus. Action Taken: No Action Taken. File C:\Programme\180Solutions\saishook.dll infected by "not-a-virus:AdvWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Programme\MSN Messenger\riched20.dll infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3CJPEG.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3HTMLMU.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3POPSWT.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3REPROX.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3RESTUB.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3WPHOOK.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\M3OUTLCN.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\M3SKIN.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSOEMON.EXE infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSOESTB.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\WINDOWS\biprep.exe infected by "not-a-virus:AdvWare.BiSpy.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\ISTactivex.dll infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\drivers\svchost.exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl.exe infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe tagged as not-a-virus:RiskWare.PSWTool.EDialer. No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WindowsXP-KB823980-x86-DEU.exe infected by "Win32.HLLP.Hantaner.a" Virus. Action Taken: No Action Taken. File D:\Dokumente und Einstellungen\Andreas\msconfig.dat infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File D:\Program Files\webHancer\Programs\whAgent.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Program Files\webHancer\Programs\whiehlpr.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Program Files\webHancer\Programs\whSurvey.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\NewDotNet\newdotnet6_30.dll infected by "not-a-virus:AdvWare.NewDotNet" Virus. Action Taken: No Action Taken. File D:\Programme\VVSN\VVSN.exe infected by "not-a-virus:AdvWare.SaveNow.z" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\Webhdll.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\WhAgent.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\whiehlpr.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\whInstaller.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\WhSurvey.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\WINDOWS\Downloaded Program Files\ieloader.dll infected by "TrojanDownloader.Win32.Small.se" Virus. Action Taken: No Action Taken. File D:\WINDOWS\Downloaded Program Files\WUInst.dll infected by "not-a-virus:AdvWare.SaveNow.ab" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\XEMP1MY6\WksPatch[1].exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YA7XMPBZ\WksPatch[1].exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\drivers\svchost.exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\firewall.exe infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\msconfig.dat infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\WINDOWS\webhdll.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\WINDOWS\whInstaller.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. So das kam raus. Sind leider ne ganze Menge :heulen: |
Kann mir mal einer kurz zwischendurch sagen, wie ich einen neuen Thread eröffnen muss ? Ich find den Button nicht.... :heulen: Gruss Goldie |
Unten links auf neues Thema. |
File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\biprep.exe infected by "not-a-virus:AdvWare.BiSpy.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl.exe infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe tagged as not-a-virus:RiskWare.PSWTool.EDialer. No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\Program Files\Common Files\Java\breg.cfg infected by "TrojanDownloader.Win32.RVP.e" Virus. Action Taken: No Action Taken. File C:\Programme\180Solutions\saishook.dll infected by "not-a-virus:AdvWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Programme\MSN Messenger\riched20.dll infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3CJPEG.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3HTMLMU.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3POPSWT.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3REPROX.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3RESTUB.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\F3WPHOOK.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\M3OUTLCN.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\M3SKIN.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSBAR.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSOEMON.EXE infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\bar\1.bin\MWSOESTB.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\Programme\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL infected by "not-a-virus:AdvWare.ToolBar.MyWebSearch" Virus. Action Taken: No Action Taken. File C:\WINDOWS\biprep.exe infected by "not-a-virus:AdvWare.BiSpy.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\ISTactivex.dll infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\nem219.dll infected by "TrojanDownloader.Win32.Dyfuca.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\drivers\svchost.exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl.exe infected by "not-a-virus:AdvWare.BargainBuddy.j" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe tagged as not-a-virus:RiskWare.PSWTool.EDialer. No Action Taken. File C:\WINDOWS\system32\msbe.dll infected by "not-a-virus:AdvWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wsem302.dll infected by "TrojanDownloader.Win32.Dyfuca.dc" Virus. Action Taken: No Action Taken. File C:\WindowsXP-KB823980-x86-DEU.exe infected by "Win32.HLLP.Hantaner.a" Virus. Action Taken: No Action Taken. File D:\Dokumente und Einstellungen\Andreas\msconfig.dat infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\mIRC\mirc.exe tagged as not-a-virus:RiskWare.mIRC.6.16. No Action Taken. File D:\Program Files\webHancer\Programs\whAgent.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Program Files\webHancer\Programs\whiehlpr.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Program Files\webHancer\Programs\whSurvey.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\NewDotNet\newdotnet6_30.dll infected by "not-a-virus:AdvWare.NewDotNet" Virus. Action Taken: No Action Taken. File D:\Programme\VVSN\VVSN.exe infected by "not-a-virus:AdvWare.SaveNow.z" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\Webhdll.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\WhAgent.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\whiehlpr.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\whInstaller.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\Programme\whInstall\WhSurvey.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\WINDOWS\Downloaded Program Files\ieloader.dll infected by "TrojanDownloader.Win32.Small.se" Virus. Action Taken: No Action Taken. File D:\WINDOWS\Downloaded Program Files\WUInst.dll infected by "not-a-virus:AdvWare.SaveNow.ab" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\XEMP1MY6\WksPatch[1].exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YA7XMPBZ\WksPatch[1].exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\drivers\svchost.exe infected by "Worm.Win32.Welchia.b" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\firewall.exe infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\WINDOWS\system32\msconfig.dat infected by "Backdoor.Spyboter.bw" Virus. Action Taken: No Action Taken. File D:\WINDOWS\webhdll.dll infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. File D:\WINDOWS\whInstaller.exe infected by "not-a-virus:AdvWare.WebHancer" Virus. Action Taken: No Action Taken. Hier nochmal das Ergebnis des eScan |
Hallo BigPluto, Du hast einige Dialer auf dem System, die Du auf Diskette sichern solltest, für den Fall, dass Du über die Telefonverbindung ins Netz gehst. Wenn Du DSL/ADSL verwendest, brauchst Du sie nicht zu sichern. Ich nehme an (Ihr dürft mich korrigieren, liebe Kollegen), dass sich die Dialer in diesen Einträgen verbergen: O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download2.abetterinternet.co...06/payload2.cab O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com...29106/flash.cab O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f007.mail.lycos.de/app/uploader/FileUploader.cab es scheint sich dabei um u.a. diesen Dialer zu handeln: File C:\WINDOWS\system32\exul.exe tagged as not-a-virus:RiskWare.PSWTool.EDialer. No Action Taken. Und dann hast Du leider eine ziemliche Ansammlung von Malware auf Deinem Computer. Ich hab bei ein paar Viren nachgeschaut: W32/Welchia.B.Worm, W32/Hantaner-A, Backdoor.Spyboter.bw alias W32/Rbot-HK ... und dieser Wurm bedeutet leider das Ende Deines derzeitigen Systems. Das Einzige, was ich Dir - zu meinem Bedauern empfehlen kann und muss, ist: Zitat:
|
Was ist auf deiner D-Partition/HD? Ein zweites Betriebssystem? Das ist auf jeden Fall extrem verseucht mit Backdoorprogrammen. Auf C ist zwar auch jede Menge Zeug, aber das wäre evtl. gerade noch so als reparabel einzustufen, auch wenn du vielleicht am besten gleich einen klaren Schnitt machst und alles neu installierst. |
Ja ich habe hier 2 Betriebssysteme. 2 mal Win Xp Professional. Bei einem der beiden funktioniert aber fast nichts. Ich hab leider keine ahnung wie ich das zweite System loswerde. |
@ BigPluto Zitat:
SD |
Ok mach ich. Und ich werde mein System neu installieren und dann die Schritte aus dem Zitat machen. Danke für die Hilfe :aplaus: |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 20:29 Uhr. |
Copyright ©2000-2024, Trojaner-Board