Hi!

Folgende Frage:

Ich war auf einer Seite, auf welcher erst von avast die xx-toolbar-installation unterbochen wurde. Ob ich danach alles richtig gemacht habe - keine Ahnung.
Ich hab avast home 4.6 und die sygate-firewall.
Ein avast-scan brachte keinen Virus. Adaware hat auch nichts gefunden.
Ich geh über eine WLAN-Verbindung (router am TV-Kabel) online.


---------------------------
Hier meine Logs:
mav:
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9EFBF860-5685-11D3-AA3D-00C04F4C5275}" refers to invalid object "cdooff.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken.

File C:\Programme\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File C:\Programme\Mplayer\System\unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

----------
Logfile of HijackThis v1.99.1
Scan saved at 06:35:44, on 12.07.2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Ahead\InCD\InCD.exe
C:\PROGRA~1\MT\MT.EXE
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\DriveCrypt\DriveCrypt.exe
C:\Programme\Free Download Manager\fdm.exe
C:\Programme\Folding@Home\winFAH.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Programme\DriveCrypt\DcrServ.exe
C:\Programme\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\Folding@Home\FahCore_78.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\s0nstwer\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [Meine Traffic] C:\PROGRA~1\MT\MT.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [DriveCrypt Startup] C:\Programme\DriveCrypt\DriveCrypt.exe /WS
O4 - HKCU\..\Run: [Free Download Manager] C:\Programme\Free Download Manager\fdm.exe -autorun
O4 - Startup: Folding@Home 5.03.lnk = ?
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Programme\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Programme\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Programme\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: DriveCrypt Service (DriveCryptService) - Unknown owner - C:\Programme\DriveCrypt\DcrServ.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Display Driver Service (Omega 1.6693) (Q) (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004\WinStylerThemeSvc.exe

Im Voraus vielen Dank!
s0nsty

Nachtrag: Ich hab das e-scan-log mal nach infected & tagged durchsucht. Infected hat er nichts gefunden, aber bei tagged ne Menge. (Soll und kann ich die betreffenden Dateien einfach löschen?? ... die liegen alle auf eine "files"-Platte, auf die fliegt immer alles erdenkliche drauf)

Mon Jul 11 22:49:50 2005 => File C:\Programme\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 22:49:59 2005 => File C:\Programme\Mplayer\System\unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 22:55:48 2005 => File D:\gamez\Quake III Arena\Check for Quake III Arena Updates.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 22:55:59 2005 => File D:\gamez\Quake III Arena\Extras\WorldNet\PCVKIT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:09 2005 => File D:\hot-new-online-stuff\filez\@games\Q3PointRelease_116n.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:09 2005 => File D:\hot-new-online-stuff\filez\@games\q3pointrelease_132.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:09 2005 => File D:\hot-new-online-stuff\filez\@games\q3pointrelease_jan1300.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:10 2005 => File D:\hot-new-online-stuff\filez\@games\Q3TFull(1).exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:43 2005 => File D:\hot-new-online-stuff\filez\@media\codecs\DivX501Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken
Mon Jul 11 23:04:44 2005 => File D:\hot-new-online-stuff\filez\@media\codecs\DivX502Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:04:44 2005 => File D:\hot-new-online-stuff\filez\@media\codecs\DivX504Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:05:19 2005 => File D:\hot-new-online-stuff\filez\@media\player\playerz_new versionz\Quicktime Pro 4.01\QuickTime%20Pro%204.1.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:05:33 2005 => File D:\hot-new-online-stuff\filez\@media\player\playerz_new versionz\xingmpeg\xmp330at.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:31 2005 => File D:\hot-new-online-stuff\filez\aaw.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:31 2005 => File D:\hot-new-online-stuff\filez\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:31 2005 => File D:\hot-new-online-stuff\filez\abesmp3.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:35 2005 => File D:\hot-new-online-stuff\filez\adaware-komplett\aawsepersonal-105.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:35 2005 => File D:\hot-new-online-stuff\filez\adaware-komplett\pllangs.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:41 2005 => File D:\hot-new-online-stuff\filez\archpr.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:41 2005 => File D:\hot-new-online-stuff\filez\arp2001t.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:55 2005 => File D:\hot-new-online-stuff\filez\bp2setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:58 2005 => File D:\hot-new-online-stuff\filez\cachm511.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:06:59 2005 => File D:\hot-new-online-stuff\filez\cdblazer2.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:07:15 2005 => File D:\hot-new-online-stuff\filez\CyberExtruder SSaver.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:07:45 2005 => File D:\hot-new-online-stuff\filez\Doc-Programme\AGSetup0601.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:08:07 2005 => File D:\hot-new-online-stuff\filez\Doc-Programme\HAUPPA~1\WINTV\SETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:09:03 2005 => File D:\hot-new-online-stuff\filez\Doc-Programme\PAINTS~1.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:09:03 2005 => File D:\hot-new-online-stuff\filez\Doc-Programme\PICVIDEO2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:09:24 2005 => File D:\hot-new-online-stuff\filez\Doc-Programme\wintv2k22.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:09:27 2005 => File D:\hot-new-online-stuff\filez\dos-patch\mfddme13.zip tagged as not-a-virus:Tool.DOS.PatchWinME. No Action Taken.
Mon Jul 11 23:09:59 2005 => File D:\hot-new-online-stuff\filez\Eraser552Setup.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:10:32 2005 => File D:\hot-new-online-stuff\filez\firemagic.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:10:32 2005 => File D:\hot-new-online-stuff\filez\firestorm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:11:09 2005 => File D:\hot-new-online-stuff\filez\FlyakiteOSXv2.0.exe tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
Mon Jul 11 23:11:16 2005 => File D:\hot-new-online-stuff\filez\GameSpyInstaller253STD.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:13:34 2005 => File D:\hot-new-online-stuff\filez\jpopt3.exe tagged as "not-a-virus:AdWare.Aureate.a". Action Taken: No Action Taken.
Mon Jul 11 23:13:34 2005 => File D:\hot-new-online-stuff\filez\kazaa_lite_171_deutsch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:13:45 2005 => File D:\hot-new-online-stuff\filez\mfddme13.zip tagged as not-a-virus:Tool.DOS.PatchWinME. No Action Taken.
Mon Jul 11 23:14:28 2005 => File D:\hot-new-online-stuff\filez\OutpostInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:14:32 2005 => File D:\hot-new-online-stuff\filez\OutpostProInstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:14:45 2005 => File D:\hot-new-online-stuff\filez\picvideo2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:16:11 2005 => File D:\hot-new-online-stuff\filez\s0nstwer1.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:16:11 2005 => File D:\hot-new-online-stuff\filez\s0nstwer2.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:16:17 2005 => File D:\hot-new-online-stuff\filez\schaf.zip tagged as not-a-virus:Effect.Win16.Sheep. No Action Taken.
Mon Jul 11 23:16:54 2005 => File D:\hot-new-online-stuff\filez\The FilmMachine 1.4.exe tagged as not-a-virus:Tool.Win32.Farnaz. No Action Taken.
Mon Jul 11 23:16:57 2005 => File D:\hot-new-online-stuff\filez\thx.zip tagged as not-a-virus:PSWTool.Win32.ZipANV. No Action Taken.
Mon Jul 11 23:17:09 2005 => File D:\hot-new-online-stuff\filez\TUSetup710.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:17:21 2005 => File D:\hot-new-online-stuff\filez\UT2003_NOCD.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:18:58 2005 => File D:\hot-new-online-stuff\filez\winsniper.zip tagged as not-a-virus:Effect.Win16.Gun. No Action Taken.
Mon Jul 11 23:20:21 2005 => File D:\hot-new-online-stuff\filez\zapro26zl26a.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:22 2005 => File D:\hot-new-online-stuff\filez\zips\RadiumMP3.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:34 2005 => File D:\hot-new-online-stuff\filez\zlsSetup_51_039_004.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:35 2005 => File D:\hot-new-online-stuff\filez\zonalm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:45 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\gimmicks\neosetupfull.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:46 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\gimmicks\xmp330at.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:20:46 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\Hacker Stuff\25.5\pwltool.zip tagged as not-a-virus:PSWTool.Win32.RePWL. No Action Taken.
Mon Jul 11 23:20:52 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\Hacker Stuff\Kreditkarten\ccmaker.zip tagged as not-a-virus:CrackTool.Win32.CCMaker. No Action Taken.
Mon Jul 11 23:20:53 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\Hacker Stuff\viren\tools\vlabtool.zip tagged as not-a-virus:Effect.DOS.Benediction. No Action Taken.
Mon Jul 11 23:20:54 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\Hacker Stuff\wasweißichdenn\revel11d.exe tagged as not-a-virus:PSWTool.Win32.SnadBoy.11. No Action Taken.
Mon Jul 11 23:21:50 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\vorsicht\455VIREN.zip tagged as not-a-virus:Tool.DOS.ReadPart. No Action Taken.
Mon Jul 11 23:21:50 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\vorsicht\newyearp.zip tagged as not-a-virus:Effect.Win16.MessageMates. No Action Taken.
Mon Jul 11 23:21:58 2005 => File D:\hot-new-online-stuff\hot_new_online_stuff_1\ZIP'S\progis\rc5des-w.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:29:36 2005 => File D:\hot-new-online-stuff\zeuchz\s0nstwer1.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:29:36 2005 => File D:\hot-new-online-stuff\zeuchz\s0nstwer2.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
Mon Jul 11 23:30:39 2005 => File D:\Julia`s Ordner\Dido-player\player\skin.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Noch ein Nachtrag: Der malware-scanner e-squared von emisoft findet nichts, aber auch gar nichts ... wem soll ich denn nun glauben ??? .... so auf bloßen Verdacht eines (!) Programms den Rechner platt zu machen ... ich weiß nicht recht!

Ein hilfreiche Antwort wäre wirklich sehr nett.
MfG

Wieso zum Geier antwortet denn hier niemand? ... ist euch die Frage zu blöd? ... ich bin wirklich SEHR dankbar für ein hilfreiche Antwort.

Hab grad xoftspy 4.15 drüber laufen lassen ... der findet "nur" einmal den MainPeanDialer und einmal die IBIS/Hunt Toolbar ... und ohne Registrieung + 40 Euro will er mir daie auch nicht weg machen ... naja, egal

Der e-square-scanner findet nichts

Adaware findet nichts ...


Also, bitte bitte (MIT SAHNE OBENDRAUF): Soll ich die von e-scan gefundenen Dateien löschen?? .. werd ich grad ausspioniert und bin offen wie ein Scheunentor?? ... was um Himmels Willen soll ich machen??

Grüße, s0nsty

Ein wenig Geduld solltest Du nun wirklich aufbringen!!!
Dein Thread ist doch erst heute morgen eröffnet!
Die Dienstleistung, die Du hier erhälst, wird von den Regulars unentgeltlich gemacht!

Soll ich die von e-scan gefundenen Dateien löschen??

Du kannst alles löschen.

... bin offen wie ein Scheunentor??

JA! Deshalb:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

SP 2 ist aktuell!

dartus

Mensch ... danke!
Ich wollte ja auch nicht unverschämt drängeln ...

Aber wenn ich hier meine traurige SP2-Geshichte ausbreite, sprenge ich (auch inhaltlich) den hiesiegen Rahmen.

Ich lösche besagte Dateien ...

Und hierüber brauche ich auch nicht besorgt die Stirn runzeln ??
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.

Entry "HKCR\CLSID\{9EFBF860-5685-11D3-AA3D-00C04F4C5275}" refers to invalid object "cdooff.dll". Action Taken: No Action Taken.

Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken.

Nochmals DANKE!
s0nsty