Hallo, ich habe folgendes Problem: Wenn ich ca. 1/2 h im Internet war, kann ich über den Internet Explorer keine Seite mehr aufrufen. Es hilft lediglich ein Neustart des Systems, dann funktioniert es wieder ca. 1/2 h...
Die Verbindungen bleiben aber intakt, soweit ich erkennen kann: Ich gehe über Tiscali-DSL ins Internet mit einem DSL-Modem Thomson Speed Toch 350 i und einer Netzwerk-Karte Marvell Yukon Gigabit Ethernet 10/100/1000Base-T Adapter, Copper RJ-45. Mein System ist Win XP SP2, die normalen Windows-Updates habe ich immer gemacht. Es läuft Norton System Works mit NAV2005. Der Virenscan ist stets unauffällig. Alle Verbindungen (Tiscali-DSL, LAN-5-Verbindung) erscheinen unter "Status" intakt, auch wenn ich mit dem Internet-Explorer keine Seite mehr aufrufen kann. Von meinen Freunden weiß keiner Rat, über Google und in verschiedenen Foren hab ich keine wirklich konkret hilfreichen Beiträge finden können.
Ich poste hier mein HijackThis-Logfile. Könnt Ihr mir helfen?

Logfile of HijackThis v1.99.1
Scan saved at 09:44:31, on 27.06.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\SOUNDMAN.EXE
F:\WINDOWS\System32\WF2K.EXE
F:\WINDOWS\system32\rundll32.exe
F:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
F:\WINDOWS\system32\CTHELPER.EXE
F:\Programme\Common files\SearchUpgrader\SearchUpgrader.exe
F:\Programme\QuickTime\qttask.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
F:\Programme\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
F:\Programme\Java\jre1.5.0_02\bin\jusched.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programme\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
F:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
F:\Programme\Sony Ericsson\Mobile\audevicemgr.exe
F:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
f:\Programme\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
F:\PROGRA~1\SONYER~1\Mobile\MOBILE~1\EPMWOR~1.EXE
F:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
F:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
F:\Programme\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
F:\WINDOWS\System32\GEARSec.exe
F:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
F:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
F:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
F:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
c:\windows\system32\dllcache\win32\winlogon.exe
c:\windows\system32\dllcache\win32\winlogon.exe
c:\windows\system32\dllcache\win32\services.exe
c:\windows\system32\dllcache\win32\csrss.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
F:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
F:\WINDOWS\System32\svchost.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
F:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
F:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
F:\WINDOWS\ISW\alice\signup\Tray.exe
F:\Programme\Internet Explorer\iexplore.exe
F:\Programme\Internet Explorer\iexplore.exe
F:\Programme\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
G:\Download\Software Download neu\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://www.alice-dsl.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.alice-dsl.de
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IE PopUp-Killer ; Neikeisoft - {49E0E0F0-5C30-11D4-945D-000000000003} - F:\PROGRA~1\Ashampoo\ASHAMP~1\PopUp.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinFoxV2] F:\WINDOWS\System32\WF2K.EXE
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [TkBellExe] "F:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SearchUpgrader] F:\Programme\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "F:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 9.0] F:\Programme\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [FFIX32] F:\WINDOWS\System32\Dractx.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "F:\Programme\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = F:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HPAiODevice(hp officejet g series) - 1.lnk = F:\Programme\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = F:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Telefonverbindungsmonitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://F:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programme\Messenger\msmsgs.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://h**p://public.windupdates.com...1f82d18b20a9e6
O16 - DPF: {27FA5271-12D2-43E3-9424-365A43236EE7} (PIXACO upload plugin) - http://h**p://www.pixaco.de/static/d...dropupload.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://h**p://software-dl.real.com/2...dxIE601_de.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://h**p://v5.windowsupdate.micro...?1097540436250
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB607F74-3191-43E6-8186-8761FEB25F51}: NameServer = 213.191.92.84 213.191.74.12
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: GEARSecurity - GEAR Software - F:\WINDOWS\System32\GEARSec.exe
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - F:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - F:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - F:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NTLOAD - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe
O23 - Service: NTSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Programme\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - F:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - F:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe

Hat ein hilfreicher Geist eine Idee? Danke...

@mi-baer
du hast einiges im system

überprüfe dein system mit escan
http://www.trojaner-board.de/showthread.php?t=17492

chaosman

Hallo Chaosman,
erstmal vielen Dank für Deine Hilfe!
Ich poste das Logfile des Virenscans mit find.bat:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Tue Jun 28 05:41:53 2005 => File F:\PROGRA~1\COMMON~1\SEARCH~1\SEARCH~1.EXE infected by "Trojan-Downloader.Win32.Keenval.g" Virus! Action Taken: No Action Taken.
Tue Jun 28 05:42:17 2005 => System found infected with Gator Spyware/Adware ({21FFB6C0-0DA1-11D5-A9D5-00500413153C})! Action taken: No Action Taken.
Tue Jun 28 05:42:17 2005 => System found infected with BlazeFind Spyware/Adware ({15ad4789-cdb4-47e1-a9da-992ee8e6bad6})! Action taken: No Action Taken.
Tue Jun 28 05:42:19 2005 => System found infected with AltnetBDE Spyware/Adware (adm25.adm25)! Action taken: No Action Taken.
Tue Jun 28 05:42:38 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Tue Jun 28 06:27:24 2005 => File C:\windows\system32\dllcache\win32\services.exe infected by "Backdoor.Win32.Iroffer.b" Virus! Action Taken: No Action Taken.
Tue Jun 28 06:34:42 2005 => File F:\NTDRLS32.dll infected by "Backdoor.Win32.Prosti.d" Virus! Action Taken: No Action Taken.
Tue Jun 28 06:55:40 2005 => File F:\Programme\Norton SystemWorks\Norton AntiVirus\Quarantine\7BFB268D.dat infected by "Email-Worm.Win32.Kindal" Virus! Action Taken: No Action Taken.
Tue Jun 28 07:35:43 2005 => File G:\Download\Software Download neu\C&C_RENEGADE_CD_KEY.exe infected by "not-virus:BadJoke.Win32.JepRuss" Virus! Action Taken: No Action Taken.
Tue Jun 28 07:35:45 2005 => File G:\Download\Software Download neu\C&C_RENEGADE_CD_KEY (1).exe infected by "not-virus:BadJoke.Win32.JepRuss" Virus! Action Taken: No Action Taken.
Tue Jun 28 08:30:32 2005 => File G:\Download\KaZaa Lite Downloads\2_CRACK NORTON ANTIVIRUS 2005.exe infected by "Backdoor.Win32.Beastdoor.206.b" Virus! Action Taken: No Action Taken.
Tue Jun 28 08:33:52 2005 => File G:\Download\KaZaa Lite Downloads\Norton Antivirus 2004 Professional + Crack.exe infected by "Virus.Win32.HLLP.Savno" Virus! Action Taken: No Action Taken.
Tue Jun 28 08:55:30 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Tue Jun 28 05:44:56 2005 => File F:\WINDOWS\system32\KILLAPPS.EXE tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 05:59:52 2005 => File C:\Hardware&Software\Creative\Treiber_Audigy_Platinum_Win_XP\AUD_EAX4DRV_031031.exe tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 06:01:01 2005 => File C:\Hardware&Software\Dance eJay 3\Dance eJay 3.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 06:01:06 2005 => File C:\Hardware&Software\Adobe Premiere 6\Adobe Premiere 6.0 - Self-Extracting.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 06:01:13 2005 => File C:\Hardware&Software\Adobe Premiere 6\Adobe Premiere 6.0 - Self-Extracting II.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 06:01:14 2005 => File C:\Hardware&Software\Adobe Premiere 6\Unzipped\Adobe_Premiere_6.0\Cleaner\cleaner.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 06:03:24 2005 => File C:\Hardware&Software\Fun\Robot Message.exe tagged as not-a-virus:Effect.Win16.MessageMates. No Action Taken.
Tue Jun 28 06:26:29 2005 => File C:\Download\Netbumper\netpumper-1[1].20.1-setup.exe tagged as "not-a-virus:AdWare.SaveNow.v". Action Taken: No Action Taken.
Tue Jun 28 06:26:46 2005 => File C:\Download\Creative Sound Blaster Audigy Platinum\6 EAX 4.0 ADVANCED HD - Treiber-Update für Sound Blaster Audigy\AUD_WEBUP_PCWDRV_1-84-40.exe tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 06:26:51 2005 => File C:\Download\Creative Sound Blaster Audigy Platinum\1 Audigy Webupdate - Audigy Treiber\AUD_EAX4DRV_031031.exe tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 06:26:56 2005 => File C:\Download\Creative Sound Blaster Audigy Platinum\7 Digital Rights Management 1.84.0045 für die Serie Sound Blaster Audigy\AUD_PCWDRV_LB_1_84_45.exe tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 06:27:25 2005 => File C:\windows\system32\dllcache\win32\csrss.exe tagged as not-a-virus:Server-FTP.Win32.Serv-U.4100. No Action Taken.
Tue Jun 28 06:37:12 2005 => File F:\Programme\Creative\SBAudigy\Program\WDM\COMMON\killapps.exe tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 06:38:40 2005 => File F:\Programme\Gemeinsame Dateien\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 07:18:35 2005 => File F:\WINDOWS\ISW\alice\signup\pdndisp.dll tagged as not-a-virus:Tool.Win32.WinCap. No Action Taken.
Tue Jun 28 07:32:39 2005 => File F:\WINDOWS\system32\KILLAPPS.EXE tagged as not-a-virus:Tool.Win32.KillApp.c. No Action Taken.
Tue Jun 28 08:22:25 2005 => File G:\Download\Software Download neu\Creative\Win 2000 XP\LiveDrvPack.exe tagged as not-a-virus:Tool.Win32.KillApp.b. No Action Taken.
Tue Jun 28 08:23:32 2005 => File G:\Download\Software Download neu\Tiscali\WinDSL-Tiscali.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Tue Jun 28 08:25:00 2005 => File G:\Download\Tools\entrypoint_setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
Tue Jun 28 08:55:30 2005 => Total Virus(es) Found: 35
Tue Jun 28 08:55:30 2005 => Total Errors: 30
Tue Jun 28 08:55:30 2005 => Time Elapsed: 03:14:20
Tue Jun 28 08:55:30 2005 => Total Objects Scanned: 99867
Tue Jun 28 05:40:15 2005 => Virus Database Date: 2005/06/28
Tue Jun 28 08:55:30 2005 => Virus Database Date: 2005/06/28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

Ist es O.K. wenn ich versuche, die malware mit einer der aufgeführten Methoden (z. B. mit dem Total Commander) zu löschen? Ich warte auf jeden Fall erstmal Antwort ab.
Vielen Dank, mi-baer

hallo mi-baer,

Tue Jun 28 06:27:24 2005 => File C:\windows\system32\dllcache\win32\services.exe infected by "Backdoor.Win32.Iroffer.b" Virus! Action Taken: No Action Taken.
Tue Jun 28 06:34:42 2005 => File F:\NTDRLS32.dll infected by "Backdoor.Win32.Prosti.d" Virus! Action Taken: No Action Taken.
Tue Jun 28 08:30:32 2005 => File G:\Download\KaZaa Lite Downloads\2_CRACK NORTON ANTIVIRUS 2005.exe infected by "Backdoor.Win32.Beastdoor.206.b" Virus! Action Taken: No Action Taken.

Bei Trojanern mit Backdoorfunktionalität wird Dir hier dringend eine Neuinstallation empfohlen.

http://de.wikipedia.org/wiki/Backdoor
http://de.wikipedia.org/wiki/Botnet

http://www.mathematik.uni-marburg.de...c-removal.html
http://www.mathematik.uni-marburg.de...ompromise.html

Empfohlene Anleitung zur Neuinstallation:
http://www.trojaner-board.de/showthread.php?t=12154

Thema Datensicherung :
http://www.trojaner-board.de/showpos...8&postcount=11

sry
dartus