Die Datei:C:\WINDOWS\system32\wuauclt.exe malhier online scannen lassen. Das Ergebnis im Fenster unten bitte wieder rein posten

Gruß Gigamail

Danke dir schon mal bis hierhin...

hier das ergebnis...

Statistiken:
Bekannte Viren: 114985 Updated: 19-01-2005
Größe der Datei (Kb): 112
Viren-Korpus: 0
Datei: 1
Warnungen: 0
Archive: 0
Verdächtigt: 0

hatte in der Datei den vermutet

dem ist aber nicht so.
Ich würde vorschlagen, prüfe Dein System mit eScan


Erstelle für den eScan einen neuen Ordner (=Verzeichnis) "bases" auf "c:\". Lade den eScan runter, entpacke ihn mit einem Zip-Programm in diesen neuen Ordner. Beachte dazu die Anleitung. Update den eScan online (siehe Anleitung) und führe ihn offline im abgesicherten Modus aus. Der eScan braucht ca 1 Stunde. Die gefundenen Viren werden von hand gelöscht. Wir geben am Forum Anleitung dazu.
(Shadowdance zitiert)

--> Teile uns bitte mit: wieviel Viren auf Deinem Rechner gefunden wurden - es sieht so aus:

=>Total Number of Files Scanned:
=>Total Number of Virus(es) Found:
***** Scanning complete. *****

--> Wie die Viren heißen, möchten wir auch wissen: "öffne die mwav.log (oder die mwXface.log) -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." (Cidre zitiert)


Gruß Gigamail

Wed Jan 19 17:14:16 2005 => Total Number of Files Scanned: 84304
Wed Jan 19 17:14:16 2005 => Total Number of Virus(es) Found: 2925
Wed Jan 19 17:14:16 2005 => Total Number of Disinfected Files: 0
Wed Jan 19 17:14:16 2005 => Total Number of Files Renamed: 2904
Wed Jan 19 17:14:16 2005 => Total Number of Deleted Files: 0
Wed Jan 19 17:14:16 2005 => Total Number of Errors: 299
Wed Jan 19 17:14:16 2005 => Time Elapsed: 01:35:31
Wed Jan 19 17:14:16 2005 => Virus Database Date: 2005/01/19
Wed Jan 19 17:14:16 2005 => Virus Database Count: 115992

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\56A51C30.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\629D79C5.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3BFE6E44.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\02D7512A.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\19CB027D.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\56C74A3F.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0C1102B7.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3DD7713C.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4D985189.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\7FF545C3.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\52C629B4.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2C260D70.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\435041DB.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\575B4A13.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4B911ABB.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\31AF7CAB.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\254E4232.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\3A2D67C4.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\52C37FB8.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\557649B6.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\6CD50138.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\57EF49E7.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\0B1232BF.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2586081A.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\746509C5.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\52C055BC.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\165A4096.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\588349BB.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\4A924AC3.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\195E138A.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\54B82385.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\2E9C2BC5.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\52BC2BBF.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

=> File C:\Programme\Norton Internet Security\Norton AntiVirus\Quarantine\18F64E5F.TMP infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

Alles die gleiche Datei am gleichen Ort... Kann ich da eifach den ordner des Nortons löschen? Es sind etwa 2500 Dateien die ich heier hinein posten müsste.... soll ich trotzdem, ist das notwendig?

Hi ,
lösche erst mal den Quarantäneordner von Norton
dann scanne nochmal mit eScan und poste das Ergebnis

eScan Hilfe


Gruß Gigamail

=> Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*

Thu Jan 20 00:09:51 2005 => Total Number of Files Scanned: 75962
Thu Jan 20 00:09:51 2005 => Total Number of Virus(es) Found: 21
Thu Jan 20 00:09:51 2005 => Total Number of Disinfected Files: 0
Thu Jan 20 00:09:51 2005 => Total Number of Files Renamed: 0
Thu Jan 20 00:09:51 2005 => Total Number of Deleted Files: 0
Thu Jan 20 00:09:51 2005 => Total Number of Errors: 299
Thu Jan 20 00:09:51 2005 => Time Elapsed: 01:25:31
Thu Jan 20 00:09:51 2005 => Virus Database Date: 2005/01/19
Thu Jan 20 00:09:51 2005 => Virus Database Count: 115992

Thu Jan 20 00:09:51 2005 => Scan Completed.

Thu Jan 20 00:10:53 2005 => Virus Database Date: 2005/01/19
Thu Jan 20 00:10:53 2005 => Virus Database Count: 115992
Thu Jan 20 00:10:57 2005 => AV Library Unloaded (3)...

Aber wieso gibt es mir 21 Viren an wenn nichts verseucht ist??

Hier hab ich mal noch den Hijackthis.log

Logfile of HijackThis v1.99.0
Scan saved at 10:08:27, on 20.01.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Programme\QuickTime\qttask.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\ScreenPrint32 v3\ScreenPrint32.exe
C:\WINDOWS\system32\pupxpman.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Programme\Trojancheck 6\tcguard.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\NMain.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Messenger\msmsgs.exe
C:\Dokumente und Einstellungen\Dani\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fan-forum.ch/forum
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.1\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programme\Gemeinsame Dateien\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Programme\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [ScreenPrint32] C:\Programme\ScreenPrint32 v3\ScreenPrint32.exe -startup
O4 - HKLM\..\Run: [mspwr] C:\WINDOWS\system32\pupxpman.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [UIWatcher] C:\Programme\Ashampoo\Ashampoo UnInstaller Platinum Suite\UIWatcher.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by12fd.bay12.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095789672949
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Kerio Personal Firewall 4 - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Macromedia Licensing Service - Unknown - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe

Was ist denn an meinem rechner faul...., er "rattert" seit neustem auch mega lang bis er ganz hinauf bzw. heruntergefahren ist.... woran liegt das??