| |
| |||||||
Log-Analyse und Auswertung: Trojaner VX2 eingefangenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.05.2005, 20:51
| #1 |
| |  Trojaner VX2 eingefangen . Brauche Hilfe Hallo zusammen. Bin neu hier auf dem Board und hoffe das mir hier jemand helfen kann. Habe mir laut Ad-Aware Se einen Trojaner Namens VX2 eingefangen den ich zwar löschen kann, aber der nach kurzer zeit wieder auftaucht. Problem stellt sich wie folgt dar: Immer wieder IE Startseite gelöscht Popups IE instabil Es war sogar einmal der Task-Manager vom ANGEBLICHEN Admin gesperrt Hab nicht wirklich Ahnung mit der Bekämpfung solcher Probleme. Das Addon von Ad-Aware erkennt den VX2 nicht einmal sondern sagt das System sei clear. Habe dann escan getested und der findet zig Trojaner, meist Win32.Agent. CWShredder kann gar nichts ausrichten. Habe dann mal HijackThis im abgesicherten Modus laufen lassen und den log angehängt. Vielleicht kann ja jemand was daraus erkennen. Logfile of HijackThis v1.98.0 Scan saved at 21:37:45, on 02.05.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Antispy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\grwhi.dll/sp.html#44768 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\grwhi.dll/sp.html#44768 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\grwhi.dll/sp.html#44768 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\grwhi.dll/sp.html#44768 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {338ADA45-032E-0500-44D8-9A67C6B26F84} - C:\WINDOWS\system32\addyd32.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programme\NVIDIA\nTune\\nTune.exe" clear O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [winsh.exe] C:\WINDOWS\system32\winsh.exe O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\RunOnce: [nttk.exe] C:\WINDOWS\system32\nttk.exe O4 - HKLM\..\RunOnce: [appfb32.exe] C:\WINDOWS\appfb32.exe O4 - HKLM\..\RunOnce: [ntxj32.exe] C:\WINDOWS\ntxj32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: officejet 6100.lnk = ? O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTS...etaStream3.cab O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} (InstallX Class) - http://www.20x2p.com/62470d8b/enter.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBD7102-8DE8-48A2-8CAC-8256E071FB8E}: NameServer = 212.185.248.180,194.25.2.129 Geändert von RRBM (03.05.2005 um 20:05 Uhr) |
|
03.05.2005, 13:31
| #3 |
| | Trojaner VX2 eingefangen Muss ich diese Aktionen eigentlich im Abgesicherten Modus machen oder kann ich den Rechner ganz normal hochfahren?
__________________Kenn mich da nicht so aus. |
|
03.05.2005, 16:34
| #4 |
| Administrator, a.D.   | Trojaner VX2 eingefangen Es wäre sinnvoller, wenn du den Cleaner im abgesicherten Modus ausführst.  |
|
03.05.2005, 16:37
| #5 |
| | Trojaner VX2 eingefangen Ich habe mal von allem nen Scan gemacht. Die ersten beiden sind vom Cleaner und danach HijackThis im Abgesicherten Modus und die beiden danach im Normalen Modus. Vielleicht könnte mir jemand sagen was das heißt?!!! Das wäre echt super. Cleaner Abgesicherter Modus (3.5.05 17:20:41) SPSeHjFix started v1.1.2 (3.5.05 17:20:41) OS: WinXP Service Pack 2 (5.1.2600) (3.5.05 17:20:41) Language: deutsch (3.5.05 17:20:41) Win-Path: C:\WINDOWS (3.5.05 17:20:41) System-Path: C:\WINDOWS\system32 (3.5.05 17:20:41) Temp-Path: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\ (3.5.05 17:20:42) Disinfection started (3.5.05 17:20:42) Bad-Dll(IEP): (not found) (3.5.05 17:20:42) Bad-Dll(IEP) in BHO: (not found) (3.5.05 17:20:42) UBF: 8 - UBB: 4 - UBR: 14 (3.5.05 17:20:42) UBF: 8 - UBB: 4 - UBR: 14 (3.5.05 17:20:42) Bad IE-pages: (none) (3.5.05 17:20:42) Stealth-String not found (3.5.05 17:20:42) Not infected->END HiJackthis Abgesichert Logfile of HijackThis v1.98.0 Scan saved at 17:24:19, on 03.05.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Antispy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {338ADA45-032E-0500-44D8-9A67C6B26F84} - C:\WINDOWS\system32\addyd32.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programme\NVIDIA\nTune\\nTune.exe" clear O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [winsh.exe] C:\WINDOWS\system32\winsh.exe O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: officejet 6100.lnk = ? O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTS...etaStream3.cab O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} (InstallX Class) - http://www.20x2p.com/62470d8b/enter.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBD7102-8DE8-48A2-8CAC-8256E071FB8E}: NameServer = 212.185.248.180,194.25.2.129 Cleaner Normaler Modus (3.5.05 17:26:45) SPSeHjFix started v1.1.2 (3.5.05 17:26:45) OS: WinXP Service Pack 2 (5.1.2600) (3.5.05 17:26:45) Language: deutsch (3.5.05 17:26:45) Win-Path: C:\WINDOWS (3.5.05 17:26:45) System-Path: C:\WINDOWS\system32 (3.5.05 17:26:45) Temp-Path: C:\DOKUME~1\Mario\LOKALE~1\Temp\ (3.5.05 17:26:46) Disinfection started (3.5.05 17:26:46) Bad-Dll(IEP): c:\windows\system32\ljmqa.dll (3.5.05 17:26:46) UBF: 8 - UBB: 4 - UBR: 14 (3.5.05 17:26:46) UBF: 8 - UBB: 4 - UBR: 14 (3.5.05 17:26:46) Bad IE-pages: deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\ljmqa.dll/sp.html#44768 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\ljmqa.dll/sp.html#44768 deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\system32\ljmqa.dll/sp.html#44768 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\system32\ljmqa.dll/sp.html#44768 deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\system32\ljmqa.dll/sp.html#44768 deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\system32\ljmqa.dll/sp.html#44768 (3.5.05 17:26:46) Stealth-String not found (3.5.05 17:26:46) No locked Files to delete. End without Reboot HiJackthis Normal Logfile of HijackThis v1.98.0 Scan saved at 17:32:22, on 03.05.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\nttk.exe C:\Programme\Norton AntiVirus\navapsvc.exe C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\winsh.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\Acrobat 6.0\Distillr\acrotray.exe C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hposol08.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Antispy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {338ADA45-032E-0500-44D8-9A67C6B26F84} - C:\WINDOWS\system32\addyd32.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programme\NVIDIA\nTune\\nTune.exe" clear O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [winsh.exe] C:\WINDOWS\system32\winsh.exe O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: officejet 6100.lnk = ? O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTS...etaStream3.cab O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} (InstallX Class) - http://www.20x2p.com/62470d8b/enter.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBD7102-8DE8-48A2-8CAC-8256E071FB8E}: NameServer = 212.185.248.180,194.25.2.129 Die Files, die der Cleaner im Normalen Modus deleted kommen aber wieder. Bitte um Hilfe Vielen Dank |
|
03.05.2005, 20:04
| #6 |
| | Trojaner VX2 eingefangen Könnte sich jemand diese LogFiles anschauen?? Vielen Dank |
|
03.05.2005, 20:22
| #7 |
| Administrator, a.D. | Trojaner VX2 eingefangen Das sieht nicht gut aus. Erstelle nochmals ein neues HJT Log-File mit der Version 1.99.1 und poste es. Lade und scanne mit eScan AntiVirus im abgesicherten Modus wie beschrieben und poste uns die Virus Log Information: Rechtsklick auf die Find.bat -> Ziel speichern unter… z.B. 'C:\Find.bat' -> Find.bat doppelklicken und den Scan abwarten -> den Inhalt [1] der automatisch erstellten C:\eScan_neu.txt hier posten. [1] Strg+A (alles markieren) -> Strg+C (kopieren) -> Strg+V (hier in den Thread einfügen). |
|
03.05.2005, 20:42
| #8 |
| | Trojaner VX2 eingefangen So, hier ist erstmal das HJT 1.99.1 Log im Abgesicherten Modus Logfile of HijackThis v1.99.1 Scan saved at 21:40:30, on 03.05.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Antispy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {338ADA45-032E-0500-44D8-9A67C6B26F84} - C:\WINDOWS\system32\addyd32.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programme\NVIDIA\nTune\\nTune.exe" clear O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iexplore.exe] C:\Programme\Internet Explorer\iexplore.exe O4 - HKLM\..\Run: [winsh.exe] C:\WINDOWS\system32\winsh.exe O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: officejet 6100.lnk = ? O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTS...etaStream3.cab O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} (InstallX Class) - http://www.20x2p.com/62470d8b/enter.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{8CBD7102-8DE8-48A2-8CAC-8256E071FB8E}: NameServer = 212.185.248.180,194.25.2.129 O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\nttk.exe" /s (file missing) O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe escan folgt dann noch thx |
|
03.05.2005, 22:21
| #9 |
| | Trojaner VX2 eingefangen Cidre Lade und scanne mit eScan AntiVirus im abgesicherten Modus wie beschrieben und poste uns die Virus Log Information: Hatte bei deiner Version Probleme. Für den Bruchteil einer sec öffnete sich ne DOS-Eingabeaufforderung und sonst nichts. Hab den Scan mit einer andere eScan Version gemacht. Hat auch einiges gefunden. Mon May 02 21:40:44 2005 => ********************************************************** Mon May 02 21:40:44 2005 => MicroWorld AntiVirus & Spyware Toolkit Utility. Mon May 02 21:40:44 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc. Mon May 02 21:40:44 2005 => ********************************************************** Mon May 02 21:40:44 2005 => Version 6.1.4 (C:\mwav\mwavscan.com) ***** VIRUS LOG INFORMATION ******* File C:\WINDOWS\system32\addyd32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\winsh.exe infected by "Trojan-Downloader.Win32.Agent.bq" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\nttk.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File System Found infected by "sw Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "se Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "hsa Spyware/Adware" Virus. Action Taken: No Action Taken. File C:\WINDOWS\apitr.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\appfb32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\atlnj32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\crdz.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\glvlo.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\gsdxk.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\msbj.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\ntxj32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\webhdll.dll_tobedeleted infected by "not-a-virus:AdWare.WebHancer" Virus. Action Taken: No Action Taken. File C:\WINDOWS\winnw.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\bvicore.dll infected by "not-a-virus:AdWare.MediaBack.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\javavr32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ntmi32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\sysqb32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ustsc.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\winxj.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\010F07AC.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\05055E08.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\06715DAC.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\08F8580F.exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\08F8580F.tmp infected by "not-a-virus:AdWare.WebHancer" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\0C021C92.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\0E4A4B3F.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\0F4B40CB.zip infected by "Trojan.Java.ClassLoader.c" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\13DC2F84.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\182A1123.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\182A1123.tmp infected by "not-a-virus:AdWare.WebHancer.214" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\19DA073E.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\19DA073E.tmp infected by "not-a-virus:AdWare.WebHancer.214" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\1C43160F.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\2178536B.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\23B3303D.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\28E56A9E.exe infected by "Trojan-Clicker.Win32.VB.gc" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\29050E7A.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\29093877.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\29093877.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\290C6273.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\290C6273.tmp infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\290F0C6F.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\290F0C6F.tmp infected by "not-a-virus:AdWare.WebHancer.214" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\2D2E72D3.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\334D3E43.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\33814E16.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\35893CE0.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\38623961.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\3D2C6BC9.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\40441CCB.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\470D216F.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\470D216F.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\473779A1.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\4AFD12C9.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\50C03EF4.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\5412293E.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\5412293E.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\59032F16.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\59032F16.tmp infected by "not-a-virus:AdWare.WebHancer.214" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\59972EEA.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\59C52F4C.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\5A2B2EBE.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\60AD48B8.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\62104BC2.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\667C280F.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\750954E4.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\760824DC.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\760824DC.tmp infected by "not-a-virus:AdWare.WebHancer.214" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\765E42C9.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\77F3140E.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\7F4A01C7.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\Programme\Norton AntiVirus\Quarantine\7FDA2801.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\apitr.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\appfb32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\atlnj32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\crdz.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\glvlo.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\gsdxk.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\msbj.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\ntxj32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\bvicore.dll infected by "not-a-virus:AdWare.MediaBack.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\javavr32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ntmi32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\sysqb32.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ustsc.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\winxj.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File C:\WINDOWS\webhdll.dll_tobedeleted infected by "not-a-virus:AdWare.WebHancer" Virus. Action Taken: No Action Taken. File C:\WINDOWS\winnw.exe infected by "Trojan.Win32.Agent.bi" Virus. Action Taken: No Action Taken. File E:\SICHERUNGEN\Multimedia\Bittorent\torrent-3.1.exe infected by "Trojan-Clicker.Win32.VB.gc" Virus. Action Taken: No Action Taken. File E:\SICHERUNGEN\Multimedia\Codecs\mp3codec.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Das sieht nicht gut aus oder???? |
|
| Themen zu Trojaner VX2 eingefangen |
| abgesicherten modus, ad-aware, adobe, antivirus, bho, brauche hilfe, ctfmon.exe, explorer, google, helfen, hijack, hijackthis, iexplore.exe, internet, internet explorer, löschen, monitor, nvcpl.dll, nvidia, officejet, pdf, programme, rundll, software, symantec, system, task-manager, trojaner, urlsearchhook, windows, windows messenger, windows xp |
Linear-Darstellung
