|
Log-Analyse und Auswertung: Wie sieht es damit aus??? DRINGEND!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.02.2005, 20:37 | #1 |
| Wie sieht es damit aus??? DRINGEND! Hallo, könnt Ihr Euch mal folgendes anschauen??? Danke schon mal im vorraus! Logfile of HijackThis v1.99.0 Scan saved at 20:18:47, on 07.02.2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSMPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\SYSTEM\SCARDSVR.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAMME\MICROSOFT HARDWARE\MOUSE\POINT32.EXE C:\WINDOWS\HAMPANEL.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAMME\MICROSOFT HARDWARE\GAME CONTROLLERS\COMMON\SWTRAYV4.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAMME\DOWNLOADWARE\DW.EXE C:\PROGRAMME\HP CD-DVD\UMBRELLA\DVDTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAMME\TCM MOUSE\MOUSEDRV.EXE C:\PROGRAMME\NORTON ANTIVIRUS\NAVAPW32.EXE C:\WINDOWS\RUNDLL32.EXE C:\PROGRAMME\MICROSOFT MONEY\SYSTEM\REMINDER.EXE C:\WINDOWS\RunDLL.exe C:\WINDOWS\SYSTEM\HIDSERV.EXE C:\PROGRAMME\NETSHOW SERVICES\TOOLS\REXPROXY.EXE C:\PROGRAMME\MICROSOFT HARDWARE\GAME CONTROLLERS\SWTRAY.EXE C:\PROGRAMME\SCANNERU\AM32.EXE C:\PROGRAMME\SCANNERU\TBRIDGE\EREG\REMIND32.EXE C:\PROGRAMME\BHODEMON 2\BHODEMON.EXE C:\T-Online\BSW4\ONLINE.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\T-ONLINE\BSW4\TODUCALC.EXE C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online F1 - win.ini: run=hpfsched O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programme\NewDotNet\newdotnet6_38.dll (disabled by BHODemon) O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Programme\MediaLoads Enhanced\ME2.DLL (disabled by BHODemon) O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Programme\Recommended Hotfix - 421701D\v15\RH.DLL (disabled by BHODemon) O2 - BHO: (no name) - {AD380126-4F12-42A1-83A6-D25933464FB1} - C:\WINDOWS\SYSTEM\EMGAFA.DLL O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [HaMFrontPanel] C:\WINDOWS\hampanel /B:Software\Ambient\HaM O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe O4 - HKLM\..\Run: [SoniqueQuickStart] C:\PROGRA~1\MEDIAS~1\SONIQUE\sqstart.exe -nostick O4 - HKLM\..\Run: [InstantAccess] C:\Programme\ScannerU\TBRIDGE\BIN\InstantAccess.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~1\GAMECO~1\COMMON\SWTRAYV4.EXE O4 - HKLM\..\Run: [MediaLoads Installer] "C:\Programme\DownloadWare\dw.exe" /H O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe" O4 - HKLM\..\Run: [Premeter] C:\PROGRA~1\NETRAT~1\PREMETER\PRMT.EXE O4 - HKLM\..\Run: [DVDBitSet] "C:\Programme\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [DVDTray] "C:\Programme\HP CD-DVD\Umbrella\DVDTray.exe O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1\MouseDrv.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programme\Gemeinsame Dateien\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKCU\..\Run: [Reminder] C:\Programme\Microsoft Money\System\reminder.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Startup: SwTray.lnk = C:\Programme\Microsoft Hardware\Game Controllers\SWTRAY.EXE O4 - Startup: Action Manager 32.lnk = C:\Programme\ScannerU\AM32.exe O4 - Startup: reminder-ScanSoft Produkt Registrierung.lnk = C:\Programme\ScannerU\TBridge\Ereg\REMIND32.EXE O4 - Startup: BHODemon 2.0.lnk = C:\Programme\BHODemon 2\BHODemon.exe O4 - Global Startup: NetShow PowerPoint Helper.lnk = C:\Programme\NetShow Services\Tools\nsppthlp.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O10 - Hijacked Internet access by New.Net O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {F0BC061F-DAF9-4533-8011-53BCB4C10307} (Installations Assistent) - http://install.download-url.de/Insta...sAssistent.ocx O18 - Filter: text/html - {8F1BEE70-FD2A-4098-BE12-CBB84AE2C5EA} - C:\WINDOWS\SYSTEM\EMGAFA.DLL O18 - Filter: text/plain - {8F1BEE70-FD2A-4098-BE12-CBB84AE2C5EA} - C:\WINDOWS\SYSTEM\EMGAFA.DLL |
07.02.2005, 20:39 | #2 |
Administrator, a.D. | Wie sieht es damit aus??? DRINGEND!__________________
__________________ |
07.02.2005, 21:33 | #3 |
| Wie sieht es damit aus??? DRINGEND! Danke erstmal. hab mal alles so gemacht und das ist das Ergebnis:
__________________Logfile of HijackThis v1.99.0 Scan saved at 21:15:46, on 07.02.2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MSMPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\WINDOWS\SYSTEM\SCARDSVR.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\RPCSS.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAMME\MICROSOFT HARDWARE\MOUSE\POINT32.EXE C:\WINDOWS\HAMPANEL.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\PROGRAMME\MICROSOFT HARDWARE\GAME CONTROLLERS\COMMON\SWTRAYV4.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAMME\HP CD-DVD\UMBRELLA\DVDTRAY.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\HIDSERV.EXE C:\PROGRAMME\TCM MOUSE\MOUSEDRV.EXE C:\PROGRAMME\NORTON ANTIVIRUS\NAVAPW32.EXE C:\PROGRAMME\MICROSOFT MONEY\SYSTEM\REMINDER.EXE C:\WINDOWS\RunDLL.exe C:\PROGRAMME\NETSHOW SERVICES\TOOLS\REXPROXY.EXE C:\PROGRAMME\MICROSOFT HARDWARE\GAME CONTROLLERS\SWTRAY.EXE C:\PROGRAMME\SCANNERU\AM32.EXE C:\PROGRAMME\SCANNERU\TBRIDGE\EREG\REMIND32.EXE C:\PROGRAMME\BHODEMON 2\BHODEMON.EXE C:\T-Online\BSW4\ONLINE.EXE C:\WINDOWS\SYSTEM\RNAAPP.EXE C:\WINDOWS\SYSTEM\TAPISRV.EXE C:\T-ONLINE\BSW4\TODUCALC.EXE C:\PROGRAMME\MOZILLA FIREFOX\FIREFOX.EXE C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\TEMP\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online F1 - win.ini: run=hpfsched O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL O2 - BHO: (no name) - {2C1FD2FD-E41C-4CB6-A85A-AD7757862A98} - C:\WINDOWS\SYSTEM\emgafa.dll (disabled by BHODemon) O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [HaMFrontPanel] C:\WINDOWS\hampanel /B:Software\Ambient\HaM O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb01.exe O4 - HKLM\..\Run: [SoniqueQuickStart] C:\PROGRA~1\MEDIAS~1\SONIQUE\sqstart.exe -nostick O4 - HKLM\..\Run: [RegisterDropHandler] C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~1\GAMECO~1\COMMON\SWTRAYV4.EXE O4 - HKLM\..\Run: [DVDBitSet] "C:\Programme\HP CD-DVD\Umbrella\DVDBitSet.exe" /NOUI O4 - HKLM\..\Run: [DVDTray] "C:\Programme\HP CD-DVD\Umbrella\DVDTray.exe O4 - HKLM\..\Run: [IW Controlcenter] C:\PROGRA~1\INSTAN~1\INSTAN~1\IWCTRL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1\MouseDrv.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\Programme\ScannerU\TBRIDGE\BIN\RegisterDropHandler.EXE O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE O4 - HKLM\..\RunServices: [SCardSvr] C:\WINDOWS\SYSTEM\SCardSvr.exe O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Programme\Gemeinsame Dateien\Symantec Shared\Script Blocking\SBServ.exe" -reg O4 - HKCU\..\Run: [Reminder] C:\Programme\Microsoft Money\System\reminder.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Startup: SwTray.lnk = C:\Programme\Microsoft Hardware\Game Controllers\SWTRAY.EXE O4 - Startup: Action Manager 32.lnk = C:\Programme\ScannerU\AM32.exe O4 - Startup: reminder-ScanSoft Produkt Registrierung.lnk = C:\Programme\ScannerU\TBridge\Ereg\REMIND32.EXE O4 - Startup: BHODemon 2.0.lnk = C:\Programme\BHODemon 2\BHODemon.exe O4 - Global Startup: NetShow PowerPoint Helper.lnk = C:\Programme\NetShow Services\Tools\nsppthlp.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {F0BC061F-DAF9-4533-8011-53BCB4C10307} (Installations Assistent) - http://install.download-url.de/Insta...sAssistent.ocx O18 - Filter: text/html - {8F1BEE70-FD2A-4098-BE12-CBB84AE2C5EA} - C:\WINDOWS\SYSTEM\EMGAFA.DLL O18 - Filter: text/plain - {8F1BEE70-FD2A-4098-BE12-CBB84AE2C5EA} - C:\WINDOWS\SYSTEM\EMGAFA.DLL |
07.02.2005, 21:53 | #4 |
Administrator, a.D. | Wie sieht es damit aus??? DRINGEND! Du hast nicht alle Punkte abgearbeitet sondern einige Teilschritte. Arbeite den Link nochmals in aller Ruhe durch und poste dann die entsprechenden Infos. |
Themen zu Wie sieht es damit aus??? DRINGEND! |
.inf, acrobat, adobe, agent, antivirus, askbar, boot, button, controlcenter, danke, dateien, dringend, explorer, firefox, hijack, hijackthis, internet, internet explorer, links, microsoft, mozilla, mozilla firefox, programme, registry, rundll, software, symantec, system, t-online, temp, windows, windows\temp |