C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP163\A0016521.EXE

Ist das Trojanische Pferd TR/Hijack.Barton.A

C:\SYSTEM VOLUME INFORMATION\_RESTORE{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP163\A0016522.EXE

Enthält eine Signatur des (gefährlichen) Backdoorprogrammes BDS/Dumador.CX.1

Diese beiden was weiß ich was das sind meldete mein AntiVir Guard wenn ich AdAware laufen lasse. AdAware hängt sich dabei auf. AntiVir alleine kann sie nicht finden und löschen und Spybot Search and Destroy findet auch nix dazu. Habe mir auch schon a2 runtergeladen, der zeigt aber auch nix an. Komisch irgendwie

Kennt sich jemand damit aus? Oder kann mir paar Tips geben? Registry hab ich schon durchsucht. Hab zwar was gefunden und das auch gelöscht, aber es kam wieder.

Danke schon mal.

Jürgen

Hallo BJKC

also die angezeigten Ordner beinhalten deine Wiederherstellungspunkte. Du bekommst die dateien weg indem du die Systemwiederherstellung deaktivierst neu bootest und danach wieder aktivierst. Das Problem ist der Backdoor, wenn der aktiv war oder noch ist solltest du dein System neu aufsetzen, aber soweit ist es noch nicht, erstelle erst einmal ein Hijack This Logfile und poste es mittels copy&paste:Direktdownload hier Denk bitte daran, damit das Programm Hijack This in einem neuen Ordner unter C: laufen sollte, siehe dazu auch Cidres Anleitung

Wichtig: in HJT Log-Files sollten aktive Links und persönliche Informationen editiert werden.
Z.B.:http:// in h**p:// und C:\Dokumente und Einstellungen\***\Eigene Dateien\hijackthis\1.99.1\HijackThis.exe

Logfile of HijackThis v1.99.1
Scan saved at 21:22:53, on 08.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\Home Cinema\PowerCinema\PCMService.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\AVPersonal\AVSched32.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Desktop Architect\datray.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\a2\a2guard.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [AceGain LiveUpdate] C:\Programme\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSched32.EXE /min
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\AOLSHARE\AOLMIcon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Desktop Architect] "C:\Programme\Desktop Architect\datray.exe" -S
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [a-squared] "C:\Programme\a2\a2guard.exe"
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} -
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1106843944468
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/de/check/qdiagh.cab?326
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programme\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: License Management Service ESD - element5 - C:\Programme\Gemeinsame Dateien\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


Is das das richtige File?

HijackThis hab ich aber nicht auf C: Installiert. Es läuft auf einer anderen Partition. Is das ok? Vielen Dank schon mal.

Jürgen
_____________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB

in deinem Logfile ist erst mal nichts aussergewöhliches zu sehen, bis auf einen Eintrag, dazu kommen wir später noch. Um Gewissheit zu erhalten scanne dein System mit eScan. Siehe dazu meinen Link in meiner Signatur

escan hat 53 viruses gefunden. Soll ich das log hier posten was das programm erstellt oder das was im Virus Fenster steht. Sorry , bin echt neu hier.

Jürgen

@BJKC
poste es wie hier in der anleitung beschrieben steht.
http://www.trojaner-board.de/showthread.php?t=17492

chaosman

Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*

Scanning File C:\Programme\AVPersonal\INFECTED\A0015941.EXE.VIR

File C:\Programme\AVPersonal\INFECTED\A0015941.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016248.EXE.VIR
C:\Programme\AVPersonal\INFECTED\A0016248.EXE.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016249.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016249.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016250.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016250.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016253.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016253.EXE.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016350.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016350.EXE.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016351.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016351.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016352.DLL.VIR
File C:\Programme\AVPersonal\INFECTED\A0016352.DLL.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016353.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016353.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016665.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016665.EXE.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\A0016666.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\A0016666.EXE.VIR infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

Scanning File C:\Programme\AVPersonal\INFECTED\UNINSTIU.EXE.VIR
File C:\Programme\AVPersonal\INFECTED\UNINSTIU.EXE.VIR infected by "Trojan.Win32.Agent.eo" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017028.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017029.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017056.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017059.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.

Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017028.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017056.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017058.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017059.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP185\A0019744.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017028.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017029.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017056.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017058.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017059.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP185\A0019744.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017028.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP166\A0017029.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017056.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017058.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP168\A0017059.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.

File C:\System Volume Information\_restore{52DFAB03-4BF1-4DFE-A55B-7F2CCDD8D2DE}\RP185\A0019744.exe infected by "Backdoor.Win32.Dumador.cx" Virus! Action Taken: No Action Taken.



Hoffe das passt so