hi!

windows upgedated...

nach dem doppelklick auf find.bat kommt das dos fenster kurz und verschwindet wieder. die escan_neu.txt datei wird aber nicht angezeigt. leider finde ich die eScan_neu.txt auch nicht über "suchen"

hab daraufhin escan gelöscht - neu installiert - auch die find.dat datei - neu gescannt (die funde manuell gelöscht) und es dann nochmal probiert.

leider war wieder keine eScan_neu.txt datei zu finden..


kann aber mit R und bearbeiten den inhalt von find.bat über den editor öffnen
[IMG]

if not exist c:\bases\mwav.log goto 1
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > C:\eScan_alt.txt
echo Funde für "infected" >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
findstr /i "infected" c:\bases\mwav.log >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
echo Funde für "tagged" >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
findstr /i "tagged" c:\bases\mwav.log >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
echo Statisktiken: >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
findstr /i "Found:" c:\bases\mwav.log >> C:\eScan_alt.txt
findstr /i "Errors:" c:\bases\mwav.log >> C:\eScan_alt.txt
findstr /i "Elapsed:" c:\bases\mwav.log >> C:\eScan_alt.txt
findstr /i "Scanned:" c:\bases\mwav.log >> C:\eScan_alt.txt
findstr /i "Date:" c:\bases\mwav.log >> C:\eScan_alt.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_alt.txt
echo ~~~~~~~ © Haui ;-) ~~~~~~~ >>C:\eScan_alt.txt
echo ~~~~~~~ Dank an Cidre ~~~~~~~ >>C:\eScan_alt.txt
:1
if not eXist c:\bases_x\mwav.log goto 2
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > C:\eScan_neu.txt
echo Funde für "infected" >> C:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
findstr /i "infected" c:\bases_x\mwav.log >> C:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
echo Funde für "tagged" >> C:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
findstr /i "tagged" c:\bases_x\mwav.log >> C:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
echo Statistiken: >>c:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
findstr /i "Found:" c:\bases_X\mwav.log >> C:\eScan_neu.txt
findstr /i "Errors:" c:\bases_x\mwav.log >> C:\eScan_neu.txt
findstr /i "Elapsed:" c:\bases_x\mwav.log >> C:\eScan_neu.txt
findstr /i "Scanned:" c:\bases_x\mwav.log >> C:\eScan_neu.txt
findstr /i "Date:" c:\bases_x\mwav.log >> C:\eScan_neu.txt
echo ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> C:\eScan_neu.txt
echo ~~~~~~~ © Haui ;-) ~~~~~~~ >>C:\eScan_neu.txt
echo ~~~~~~~ Dank an Cidre ~~~~~~~ >>C:\eScan_neu.txt
:2 exit



ogfile of HijackThis v1.99.1
Scan saved at 16:31:10, on 02.05.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Programme\Microsoft Office\Office10\WINWORD.EXE
C:\Programme\Microsoft Works\WkDStore.exe
C:\hijack\hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [FlashIcon] C:\Programme\Generic\USB Card Reader Driver v2.2e5\FlashIcon.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ysdiqw] c:\windows\system32\dzzthvb.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [InstantTray] C:\Programme\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{DE7028B3-B8EF-4543-AF6A-27996EE14120}: NameServer = 195.70.255.131,195.70.244.61
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

windows upgedated

Nein, dein Log-File spricht aber eine andere Sprache...

leider war wieder keine eScan_neu.txt datei zu finden..

Dann durchsuche manuell die mwav.log und poste die Funde:
Öffne die mwav.log im Ordner C:\bases_x -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.

kann aber mit R und bearbeiten den inhalt von find.bat über den editor öffnen

Das ist klar.

Mon May 02 14:25:59 2005 => File c:\windows\system32\dzzthvb.exe infected by "Trojan.Win32.Agent.cp" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:03 2005 => File C:\WINDOWS\system32\drivers\delprot.sys infected by "Trojan.Win32.Delprot.a" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:09 2005 => File C:\WINDOWS\svcproc.exe infected by "Trojan.Win32.Stervis.c" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:10 2005 => System found infected with text/html Spyware/Adware! Action taken: No Action Taken.
Mon May 02 14:26:10 2005 => File System Found infected by "text/html Spyware/Adware" Virus. Action Taken: No Action Taken.


Mon May 02 14:26:10 2005 => System found infected with grokster Spyware/Adware! Action taken: No Action Taken.
Mon May 02 14:26:10 2005 => File System Found infected by "grokster Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:10 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Mon May 02 14:26:10 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:11 2005 => File C:\WINDOWS\Bolger.dll infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.

C:\WINDOWS\icont.exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:14 2005 => File C:\WINDOWS\jfizafouliq.exe infected by "not-a-virus:AdWare.BetterInternet" Virus. Action Taken: No Action Taken.


Mon May 02 14:26:18 2005 => File C:\WINDOWS\Nail.exe infected by "not-a-virus:AdWare.BetterInternet.b" Virus. Action Taken: No Action Taken.


Mon May 02 14:26:26 2005 => File C:\WINDOWS\System32\akcore.dll infected by "not-a-virus:AdWare.Coreak" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:26 2005 => Scanning File C:\WINDOWS\System32\aklsp.dll
Mon May 02 14:26:26 2005 => File C:\WINDOWS\System32\aklsp.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:26 2005 => Scanning File C:\WINDOWS\System32\akrules.dll
Mon May 02 14:26:26 2005 => File C:\WINDOWS\System32\akrules.dll infected by "Trojan-Downloader.Win32.Agent.bt" Virus. Action Taken: No Action Taken.

Mon May 02 14:26:26 2005 => Scanning File C:\WINDOWS\System32\akupd.dll
Mon May 02 14:26:26 2005 => File C:\WINDOWS\System32\akupd.dll infected by "Trojan-Downloader.Win32.Agent.br" Virus. Action Taken: No Action Taken.

Uff..
dafür ist also das skript?

Jetzt postest du noch folgendes aus der mwav.log (steht ganz am Ende):

Total Number of Files Scanned:
Total Number of Virus(es) Found:
Total Number of Disinfected Files:
Total Number of Files Renamed:
Total Number of Deleted Files:
Total Number of Errors:
Time Elapsed:

Mon May 02 15:31:26 2005 => ***** Scanning complete. *****

Mon May 02 15:31:26 2005 => Total Objects Scanned: 51475
Mon May 02 15:31:26 2005 => Total Virus(es) Found: 39
Mon May 02 15:31:26 2005 => Total Disinfected Files: 0
Mon May 02 15:31:26 2005 => Total Files Renamed: 0
Mon May 02 15:31:26 2005 => Total Deleted Objects: 0
Mon May 02 15:31:26 2005 => Total Errors: 12
Mon May 02 15:31:26 2005 => Time Elapsed: 01:05:52
Mon May 02 15:31:26 2005 => Virus Database Date: 2005/05/02
Mon May 02 15:31:26 2005 => Virus Database Count: 127997

Mon May 02 15:31:26 2005 => Scan Completed.

Mon May 02 16:17:27 2005 => Virus Database Date: 2005/05/02
Mon May 02 16:17:28 2005 => Virus Database Count: 127997
Mon May 02 16:17:37 2005 => AV Library Unloaded (3)...

hab jetzt windows auch wirklich upgedated..