Beste Menschen,

Mein computer wird ganz langszam und stopt manchmal. Also habe ich gerade der Antivir laufen lassen und findet "Fr/Dldr.dyfuca.ds virus. Es geht nicht weg wenn man es delete.

Also habe ich ein logfile gemacht. Kann jemand mir helfen.. ich bin ganz neu hier.

Logfile of HijackThis v1.99.1
Scan saved at 0:14:40, on 1-6-05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\MESSENGER PLUS! 3\MSGPLUS.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\AVPERSONAL\AVSCHED32.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\NL\MSNAPPAU.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE
C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCK.EXE
C:\PROGRAM FILES\MEDIA ACCESS\MEDIAACCESS.EXE
C:\WINDOWS\SYSTEM\AP9H4QMO.EXE
C:\PROGRAM FILES\DIAMOND\INCONTROL TOOLS 98\DMHKEY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AVPERSONAL\AVWIN.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\PROGRAM FILES\ACCESSORIES\FILZIP\FILZIP.EXE
C:\WINDOWS\TEMP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.nl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer aangeboden door Tiscali
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.03.0000.1005\EN-XU\STMAIN.DLL
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Taakcontrole] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [UIUCU] C:\WINDOWS\TEMP\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [AVSCHED32] C:\PROGRAM FILES\AVPERSONAL\AVSCHED32.EXE /min
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\nl\msnappau.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Ad-aware] "C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\AD-AWARE.EXE" +c
O4 - HKLM\..\Run: [Media Access] C:\PROGRAM FILES\MEDIA ACCESS\MediaAccK.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Device Detection] C:\PROGRAM FILES\AH FOTOSERVICE\dd.exe
O4 - Startup: InControl Desktop Manager.lnk = C:\Program Files\Diamond\InControl Tools 98\DMHKEY.EXE
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\MSN Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\MSN Messenger\MSMSGS.EXE
O12 - Plugin for .ivp: C:\PROGRA~1\INTERN~1\Plugins\npiscplg.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.nl
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Me...bridge-c18.cab

Merci.
STEFAN

@Stefke
HJT soll aus einem speziell angelegten Ordner ausgeführt werden.
Bitte alle Links im Log deaktivieren (z.B. h**p statt http)

Bitte alle diese Einträge fixen

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O4 - HKLM\..\Run: [UIUCU] C:\WINDOWS\TEMP\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\SYSTEM\ap9h4qmo.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://h**p://static.windupdates.com...bridge-c18.cab

Ordner

C:\Windows\Temp
c:\temp

im abgesicherten Modus leeren.

Diese Dateien im abgesicherten Modus löschen.

C:\WINDOWS\SYSTEM\wucrtupd.exe
C:\WINDOWS\SYSTEM\ap9h4qmo.exe

Danch mache bitte noch Folgendes:
1. Dieses Bereinigungsprogramm hilft dir, den ganzen Müll aus den Temp-Ordner und Papierkorb zu entfernen.
2. Infected-Ordner des Antivirus-Programms, ggf. auch von Spybot Search & Destroy, Ad-Aware usw. leeren. Der Name des Ordners sowie Pfad sind Programm- und Benutzerabhängig. Bitte RTFM zum AV-Programm. Bei einigen Programmen (z. B. AVPE) ist diese Option nicht im Programm integriert. In dem Fall soll dies manuell erfolgen.
3. eScan genau nach Anleitung (bitte ausdrucken und aufmerksam lesen) im abgesicherten Modus laufen lassen. Log hier Posten.

Hallo Rene!

Vielen vielen dank fuer die Hilfe, internet gibt virus und Hilfe...! Ich habe gemacht was du gesagt hast. Und die Computer funktioniert schon schneller!

Herrlich ist das.

Ich verstehe aber noch nicht ganz was du meinst mit "links im log deaktivieren.." h**p...

Aber.. es ist alles schon viel besser. Wieder ein Hollaender froh.

Die log habe ich hier gepostet... habe ich das richtige gepostet? Es ist direct aus das escan Programm.

Gruusch dich recht herzlich.
Stefan


Fri Jun 10 03:09:23 2005 => ***** Scanning Registry and File system for Adware/Spyware *****

Fri Jun 10 03:10:06 2005 => ***** Scanning Registry for errors created because of A
dware/Spyware *****

Fri Jun 10 03:10:52 2005 => ***** Scanning System32 Folders *****
Fri Jun 10 03:10:52 2005 => Scanning C:\WINDOWS Directory
Fri Jun 10 03:10:52 2005 => Scanning Folder: C:\WINDOWS\*.*
Fri Jun 10 03:11:52 2005 => Scanning C:\WINDOWS\SYSTEM Directory
Fri Jun 10 03:11:52 2005 => Scanning Folder: C:\WINDOWS\SYSTEM\*.*

Fri Jun 10 03:15:56 2005 => Scanning C:\WINDOWS\TEMP Directory
Fri Jun 10 03:15:56 2005 => Scanning Folder: C:\WINDOWS\TEMP\*.*
Fri Jun 10 03:15:57 2005 => Scanning Folder: C:\WINDOWS\TEMP\Adobe\*.*
Fri Jun 10 03:15:57 2005 => Scanning Folder: C:\WINDOWS\TEMP\Adobe\Acrobat\*.*
Fri Jun 10 03:15:57 2005 => Scanning Folder: C:\WINDOWS\TEMP\Adobe\Acrobat\6.0\*.*
Fri Jun 10 03:16:16 2005 => Scanning Folder: C:\WINDOWS\TEMP\Download\*.*
Fri Jun 10 03:16:16 2005 => Scanning Folder: C:\WINDOWS\TEMP\Bases_X\*.*

Fri Jun 10 03:16:18 2005 => Scanning C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5 Directory
Fri Jun 10 03:16:18 2005 => Scanning Folder: C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5\*.*
Fri Jun 10 03:16:18 2005 => Scanning Folder: C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5\RVKLAHIV\*.*
Fri Jun 10 03:16:36 2005 => Scanning Folder: C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5\W9ABC1QF\*.*
Fri Jun 10 03:16:57 2005 => Scanning Folder: C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5\MBC7QFA5\*.*
Fri Jun 10 03:17:07 2005 => Scanning Folder: C:\WINDOWS\LOCALS~1\TEMPOR~1\CONTENT.IE5\YJ1LDIEC\*.*

Fri Jun 10 03:17:24 2005 => ***** Checking for specific ITW Viruses *****
Fri Jun 10 03:17:24 2005 => Checking for Welchia Virus...
Fri Jun 10 03:17:24 2005 => Checking for LovGate Virus...
Fri Jun 10 03:17:25 2005 => Checking for CodeRed Virus...
Fri Jun 10 03:17:25 2005 => Checking for OpaServ Virus...
Fri Jun 10 03:17:25 2005 => Checking for Sobig.e Virus...
Fri Jun 10 03:17:25 2005 => Checking for Winupie Virus...
Fri Jun 10 03:17:25 2005 => Checking for Swen Virus...
Fri Jun 10 03:17:25 2005 => Checking for JS.Fortnight Virus...
Fri Jun 10 03:17:25 2005 => Checking for Novarg Virus...
Fri Jun 10 03:17:25 2005 => Checking for Pagabot Virus...
Fri Jun 10 03:17:25 2005 => Checking for Parite.b Virus...
Fri Jun 10 03:17:25 2005 => Checking for Parite.a Virus...
Fri Jun 10 03:17:25 2005 => Checking for Adware.SeekSeek Virus...

Fri Jun 10 03:17:25 2005 => ***** Scanning complete. *****
Fri Jun 10 03:17:25 2005 => Total Objects Scanned: 11396
Fri Jun 10 03:17:25 2005 => Total Virus(es) Found: 2
Fri Jun 10 03:17:26 2005 => Total Disinfected Files: 0
Fri Jun 10 03:17:26 2005 => Total Files Renamed: 0
Fri Jun 10 03:17:26 2005 => Total Deleted Objects: 0
Fri Jun 10 03:17:26 2005 => Total Errors: 26
Fri Jun 10 03:17:26 2005 => Time Elapsed: 00:08:57
Fri Jun 10 03:17:26 2005 => Virus Database Date: 2005/06/09
Fri Jun 10 03:17:26 2005 => Virus Database Count: 134027

Fri Jun 10 03:17:26 2005 => Scan Completed.


Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\yacsui.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\yacscom.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Ahead\CoverDesigner\covered-deu.nls". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\yacsui.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\yacscom.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\pxwma.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\pxsfs.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D3B1DE00-6B94-1069-8754-08002B2BD64F}" refers to invalid object "C:\WINDOWS\SYSTEM\disktool.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}" refers to invalid object "C:\PROGRAM FILES\AH FOTOSERVICE\MSVBVM60.DLL". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{9EFBF860-5685-11D3-AA3D-00C04F4C5275}" refers to invalid object "cdooff.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" refers to invalid object "C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\NL\MSNTB.DLL". Action Taken: No Action Taken.
Entry "HKCR\Overview.Document" refers to invalid object "{DA23B9C9-6893-11D0-8534-00C04FD7AD0C}". Action Taken: No Action Taken.
Entry "HKCR\TSHOOT.TSHOOTCtrl.1" refers to invalid object "{4B106874-DD36-11D0-8B44-00A024DD9EFF}". Action Taken: No Action Taken.
Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken.
Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken.
Entry "HKCR\AcroIEHelper.AcroIEHlprObj.1" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken.
Entry "HKCR\AcroIEHelper.AcroIEHlprObj" refers to invalid object "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}". Action Taken: No Action Taken.


MERCI