Hallo,
nachdem ich hier sehe, wie kompetent hier geholfen wird, bitte ich Euch mir zu helfen.

Wie auch schon diverse Andere hier habe ich das Problem, dass sich meine Startseite des IE6 auf den Indexfox umstellt.

Bevor jetzt kommt: "Wer nimmt schon IE... " Ich werde den Browser wechseln, jedoch nicht eher, bevor die Ursache des Problems gelöst/entfernt ist.

Ich habe KEIN SP2 installiert, da es zu inkompatibilitäten mit mancher Software bei mir käme.


BTT:
Hier ist das HJT LOG File:


Logfile of HijackThis v1.99.1
Scan saved at 16:09:20, on 13.07.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Analog Devices\SoundMAX\SMTray.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
K:\AceGain\LiveUpdate\LiveUpdate.exe
K:\AceGain\LiveUpdate\aceagent.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programme\WZCBDL Service\WZCBDLS.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\PROGRA~1\FlashGet\flashget.exe
D:\0505\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w*w.google.de/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O2 - BHO: (no name) - {BD9FC92D-75FD-4DB1-8D1A-6FEDED97561B} - C:\WINDOWS\System32\6to4svcd.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AceGain LiveUpdate] K:\AceGain\LiveUpdate\LiveUpdate.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programme\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Alles mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Backward Links - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Shorten URL - http://w*w.cjb.net/menuext.html
O8 - Extra context menu item: Similar Pages - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programme\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - h*tp://a1540.g.akamai.net/7/1540/52/20040105/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h*tp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120659787484
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - h*tp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D787139-ACDA-4718-AB05-92A36AC11F77}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3BA2CC3-43F1-4A61-90E9-4CD095F2DFF9}: NameServer = 192.168.1.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TSMService - T-Systems Nova, Berkom - C:\Programme\T-DSL SpeedManager\tsmsvc.exe
O23 - Service: WZCBDL Service (WZCBDLService) - D-Link - C:\Programme\WZCBDL Service\WZCBDLS.exe






Ich hoffe sehr, dass Ihr mir helfen könnt.

Vielen Dank schon einmal

EDIT: Noch was vergessen: Spybot und Adaware wurden ausgeführt => keine Bedrohungen gefunden.
Mein Rechner ist via Router im Netz.

Zitat von Thorty

O8 - Extra context menu item: Shorten URL - http://w*w.cjb.net/menuext.html

Also, wenn ich Sophos da richtig sehe, dann hast Du wohl zuminest diesen Freund hier auf dem Rechner (Troj/IEStart-K):

http://www.sophos.de/virusinfo/analy...jiestartk.html

Zitat von Thorty

Ich habe KEIN SP2 installiert, da es zu inkompatibilitäten mit mancher Software bei mir käme.

Die Inkompatibilität ist kein so recht gutes Argument für ein ungepatchtes System. Da mußt Du Dir schon überlegen, was Dir da lieber ist. Mir wäre ein aktell gepatchtes System deutlich lieber. Hatte mit SP2 auch zunächst Probleme, habe dann den Rechner einmal komplett neu aufgesetzt und alle SW-Komponenten, die vorher ohne Probleme liefen, taten dies dann auch.

An Deiner Stelle würde ich mal einen escan nach der Anleitung von Cidre über Dein System laufen lassen (Anleitung unbedingt aufmerksam durchlesen, bevor Du Dich ans Werk begibst....)

http://www.trojaner-board.de/showthread.php?t=17492

Hallo Wuslon.

Danke für Deine Antwort. Dieses "ht+p://w*w.cjb.net/menuext.html" hatte ich auch schon im Auge. Hängt der denn mit dem tollen Indexfox zusammen?


Also bei der inkompatiblen Software handelt es sich um mein Norton AV, deshalb hatte ich da etwas "Bauchschmerzen" Aber nen Versuch ists wert


Escan hab ich laufen lassen und werde die entsprechenden Stellen fixen.


Danke erstmal Vielleicht findet ja noch jemand etwas

Zitat von Thorty

Escan hab ich laufen lassen und werde die entsprechenden Stellen fixen.

poste dochmal die funde gem. Anleitung.....

Moin moin,

das posten des Logs geht leider erst heute Abend nach dem "erfrischenden" Tag im Büro

Ich hab die Escan tipps gefixt, ausser die "unwise" Deinstallationsroutinen (Win32boot). Was Escan gefunden hatte, waren Dateien im Quarantäne Ordner meines AV Proggies.

Nabend, so dies ist der Escan Bericht:



Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "ISearchTech.ISTdownloader Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\axload.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\installer_MARKETING32.exe". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\internazionale_ver11.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\tdserver.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\WinTaskAdX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\objsafe.tlb". Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\Thorsten\Eigene Dateien\Eigene Bilder\Aircraft\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Dokumente und Einstellungen\Thorsten\Lokale Einstellungen\Anwendungsdaten\IM\Identities\{99920ADE-70E7-4EBA-A8C3-9B46D654ABD6}\Message Store\Attachments\Schaf.zip tagged as not-a-virus:Effect.Win16.Sheep. No Action Taken.
File C:\Dokumente und Einstellungen\Thorsten\Lokale Einstellungen\Temp\dsw1F.tmp tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Downloads\aaw6.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\escheck\ECBackup\1E1A129E.tmp.bkp infected by "Trojan-Downloader.Win32.Delf.hb" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\552E6A38.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\5BCF18EA.dll.bkp infected by "Trojan-Clicker.Win32.Adpower.b" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\5BD242E7.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\5BD56CE3.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.ij" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\5BD816E0.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\5BDC40DC.exe.bkp infected by "Trojan-Downloader.Win32.IstBar.jm" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\62223F03.exe.bkp infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\68F75DF2.exe.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\70C373AC.exe.bkp infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\F9tTeb.xxx.bkp infected by "Trojan-Downloader.Win32.IstBar.jl" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\keygen.exe.bkp infected by "Trojan-Clicker.Win32.NoName.a" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\tIcB8a.xxx.bkp infected by "Trojan-Downloader.Win32.IstBar.jl" Virus! Action Taken: No Action Taken.
File C:\escheck\ECBackup\_in10b6s.dlt.bkp infected by "Trojan-Dropper.Win32.Mudrop.k" Virus! Action Taken: No Action Taken.
File C:\Programme\ARCHPR\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\FlashGet\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\ICQLite\Unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\IncrediMail\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\Lavasoft\Ad-aware 6\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\04E903C1.dll tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\060E04AD infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\084D6235 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\0A680FC0 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\0BFA0C45 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\0C0B5E33 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\127B29BB infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\173D117C infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\174B396E infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\175B0B5C infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\18867DE5 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\18A87FB1 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\1B105ADE infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\1B2600C4 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\1EDD6042 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\21A25707.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\21A87605 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\22CB01DD.exe tagged as "not-a-virus:AdWare.CashBack.b". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\248038A5 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\25F532F5.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\26860436.dll tagged as "not-a-virus:AdWare.ToolBar.YourSiteBar.c". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\26860436.exe tagged as "not-a-virus:AdWare.Atlas.e". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\288D18A8.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\28D156D4.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\28D400D0.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\2D265E7D tagged as "not-a-virus:AdWare.WinAD". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\2D3D6DBF infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\34B60D38.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\35173585 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\39C04822 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\3D437D81 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\3D820846 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\3E321C0D infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\41704A51.dll tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\41704A51.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\4173744D.dll tagged as "not-a-virus:AdWare.WinAD.ak". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\4173744D.exe tagged as "not-a-virus:AdWare.CashBack.e". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\41761E4A.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\41761E4A.srg tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\41761E4A.vxd tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\417A4846.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\42907AB7 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\429D22A9 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\42A7209E infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\42AD7497 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\45BA7DCC infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\46CD2C67 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\4AFE1090 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\4E3F424C.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\4E485A77 infected by "Trojan.Win32.Dialer.ep" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\51E51DD7 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\585D14F8 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5A0D2938 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5BD242E7.CAB infected by "Trojan-Clicker.Win32.Adpower.b" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5BD816E0.dll tagged as "not-a-virus:AdWare.ToolBar.SideFind". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5BDC40DC.dll tagged as "not-a-virus:AdWare.ToolBar.SideFind". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5D0323DE.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\5D0323DE.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\60505613 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\60573031 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\60BE2637.exe tagged as "not-a-virus:AdWare.Atlas.e". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\6251773B tagged as "not-a-virus:AdWare.WinAD". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\65FE643E infected by "Trojan-Dropper.Win32.Small.sf" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\688C3FAA tagged as "not-a-virus:AdWare.VirtualBouncer.d". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\68935FDC.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\6CD14638 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\700A57A1 infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\71023DEA.txe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\714C30D1.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\744D3BBE infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\77802694 tagged as "not-a-virus:AdWare.WinAD.ah". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\79B453FF infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\7A20796E infected by "Email-Worm.Win32.NetSky.d" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\7DAA239F.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.
File C:\Programme\Norton AntiVirus\Quarantine\7DBF0B4F infected by "Email-Worm.Win32.Sober.i" Virus! Action Taken: No Action Taken.
File C:\Programme\Norton SystemWorks\Norton CleanSweep\Backup\read3508.BUD tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\RECYCLER\S-1-5-21-1078081533-343818398-839522115-1003\Dc1\19-Dec-2003\zSetup_45_538.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089755.exe infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089756.exe infected by "Trojan-Downloader.Win32.IstBar.ju" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089757.exe infected by "Trojan-Downloader.Win32.IstBar.jm" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089758.exe infected by "Trojan-Downloader.Win32.IstBar.ij" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089759.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089760.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089761.exe infected by "Trojan-Downloader.Win32.Dyfuca.dx" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089762.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{E46F9A1C-8AB7-467E-A3E7-71A54E4334EB}\RP754\A0089763.dll infected by "Trojan-Clicker.Win32.Adpower.b" Virus! Action Taken: No Action Taken.
File C:\test\DriveScrubber\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\system32\Macromed\Shockwave 10\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\system32\msbb321.dll tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken.
File D:\0105\archpr\setup.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\0105\archpr.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\0105\rarkeyd.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\0205\AmericasArmy220_NVIDIA.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\0505\DriveScrubber.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\0705\iSearchFix.exe tagged as not-a-virus:Tool.Win32.Processor.20. No Action Taken.
File D:\aaw6.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\aida32ee_393.exe tagged as not-a-virus:Tool.Win32.AIDA.3862. No Action Taken.
File D:\DivXPro511Adware.exe tagged as "not-a-virus:AdWare.Gator.3202". Action Taken: No Action Taken.
File D:\Download\IncrediMail.Xe.Premium.4.00.Build.1874.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\k700i(5000 logos_couleurs_300 apps&gams_java 100 sonneries_ringtones_bypilouz.rar tagged as not-a-virus:RemoteAdmin.Win32.WinVNC-based.c. No Action Taken.
File D:\Download\Passware.Password.Recovery.Kit.Enterprise.v7.0-Passware.rar tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\Weight Watchers Point Calculator.zip tagged as "not-a-virus:AdWare.MetaDirect.b". Action Taken: No Action Taken.
File D:\Download\IncrediMail.Premium.Xe.Deutsch.Build.1338.Full.(by.king-alp)\IncrediMailSetup 1338 Deutsch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\Juli\csru41full.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\Mai\benaliases_v55dt.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\Mai\ec22.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\sept\WolfET.exe.jc! tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\19-Dec-2003\zapSetup_45_538.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Download\Setup_40_146_029.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\fgf150.exe tagged as "not-a-virus:AdWare.Cydoor". Action Taken: No Action Taken.
File D:\Finger.zip infected by "not-virus:BadJoke.Win32.Finger.b" Virus! Action Taken: No Action Taken.
File D:\IncrediMail\IncrediMailSetup_de.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\IncrediMail\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\Langeweile.zip tagged as not-a-virus:Joke.Win32.Buttons.a. No Action Taken.
File D:\Langeweile1_1.zip tagged as not-a-virus:Joke.Win32.Langeweile. No Action Taken.
File D:\RECYCLER\S-1-5-21-1078081533-343818398-839522115-1003\Dd1.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\temp\IncrediMail.Premium.Xe.Deutsch.Build.1338.Full.(by.king-alp)\IncrediMailSetup 1338 Deutsch.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\temp\Lavasoft.Ad-Aware.v6.0.181.Professional-ACME.\Lavasoft.Ad-Aware.v6.0.181.\Ad-aware.6.Pro.Built.181.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File I:\games\Earth 2160\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File K:\Games\Battlefield 2\Redist\ArcadeInstallBATTLEFIELD2_20.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.






Ich will es erst einmal soweit fixen, wie es geht, hab ja nix zu verlieren und kann daraus nur lernen.

EDIT: automatische Wiederherstellung ist nun deaktiviert. also ein Teil der "Bösewichter" dürfte sich im nachhinein nicht mehr blicken lassen.

Die Quarantänefiles können doch ohne weiteres gelöscht werden, oder?

EDIT2: SP2 installiert.


Es wäre nett, wenn Ihr mit helfen könntet.
Danke

Spontane Aussage?

Hoffnungslos verseucht. Ich würde das System neu aufsetzen. Cracks, meiner Meinung?

Anleitung zum sicheren Neuaufsetzen:

http://www.trojaner-board.de/showthread.php?t=12154

Warum? Du hast/hattest Backdoortrojaner auf dem System und damit ist Dein System nicht mehr vertrauenswürdig.

An Deiner Stelle würde ich Filesharing in Zukunft mit einem höheren Maß an Vorsicht betreiben.

Hi Wuslon, hab gestern abend auch schon einiges zum Neuaufsetzen vorbereitet...
Jedoch will ich erstmal versuchen so viel wie möglich so noch zu fixen, da ich aus der ganzen Sache noch etwas lernen kann.

Wo war der Backdoor? Könntest Du mir bitte das File nennen?

Die meisten verdächtigen Files sind im Quarantäneordner und sofort von meinem Email Proggie abgefangen worden.

Die anderen sind zumeist "Tagged as..." Was sagt mir das?