ESCAN: 30 Treffer, bitte um Hilfe

Chibby

In letzter Zeit finde ich mit ad-aware, xp-clean, spybot s&a immer wieder die gleichen Viren, die ich dann lösche, aber immer wieder kommen. Ich weiß nicht so Recht was ich tun soll, deswegen hab ich mal einen Scan mit ESCAN gemacht. Hier das Ergebnis, ich bitte um Hilfe, was ich tun soll.

Mon Jul 18 16:28:11 2005 => System found infected with BearShare Spyware/Adware ({905d0df2-3a0a-4d94-853c-54a12a745905})! Action taken: No Action Taken.

Mon Jul 18 16:28:11 2005 => System found infected with BearShare Spyware/Adware ({9f95f736-0f62-4214-a4b4-caa6738d4c07})! Action taken: No Action Taken.

Mon Jul 18 16:28:11 2005 => System found infected with BearShare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken.

Mon Jul 18 16:28:11 2005 => System found infected with BearShare Spyware/Adware ({5f95e1af-2620-4f15-bdf9-7fdce4607e17})! Action taken: No Action Taken.

Mon Jul 18 16:28:31 2005 => System found infected with BearShare Spyware/Adware (bearshare.lnk)! Action taken: No Action Taken.



--------------------------------------------------------------------------


Mon Jul 18 16:29:59 2005 => File C:\WINDOWS\system32\f3PSSavr.scr tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.

Mon Jul 18 16:31:58 2005 => File C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\saveinstwm.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken.

Mon Jul 18 16:35:58 2005 => File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\saveinstwm.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken.

Mon Jul 18 16:42:10 2005 => File C:\Programme\BearShare\Installer\saveinstwm.exe tagged as "not-a-virus:AdWare.SaveNow.z". Action Taken: No Action Taken.

Mon Jul 18 16:42:12 2005 => File C:\Programme\BearShare\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 16:50:45 2005 => File C:\Programme\ICQLite\Unwise32.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 16:52:53 2005 => File C:\Programme\Lavasoft\Ad-aware 6\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 16:58:20 2005 => File C:\Programme\MP3 Player Utilities V1.22\RDiskUtility\sys\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken.

Mon Jul 18 16:58:45 2005 => File C:\Programme\MSN Messenger\riched20.dll tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.

Mon Jul 18 16:59:59 2005 => File C:\Programme\themexp\Themexp.org File\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 17:20:00 2005 => File C:\WINDOWS\system32\f3PSSavr.scr tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken.

Mon Jul 18 18:16:02 2005 => File E:\Call of Duty\Uninstall\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 18:41:25 2005 => File E:\Vietcong\Vietcong\No CD\Vietcong1.30 German Fix exe No Cd\Vietcong1.30_Ger_Fix_Patch.exe tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.

Mon Jul 18 18:41:26 2005 => File E:\Vietcong\Vietcong\No CD\Vietcong1.30 German Fix exe No Cd.zip tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.

Mon Jul 18 18:42:00 2005 => File E:\Vietcong\Vietcong\Vietcong1.30_Ger_Fix_Patch.exe tagged as not-a-virus:Tool.Win32.TPE.a. No Action Taken.

Mon Jul 18 20:31:39 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\My Games\Counter Strike Steam\Counter Strike 1.6 + Half Life 1.1.2.0 + Steam Full By Adriath.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 20:42:56 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\My Games\Counter Strike Steam\steaminstall_cs.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 20:44:07 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\Setups & Updates\aaw6181.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 20:44:26 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\Setups & Updates\BSINSTALLDE5.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 20:50:34 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\Setups & Updates\zlsSetup_51_039_004.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Mon Jul 18 20:52:51 2005 => File G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\Setups & Updates\[PC game] Worms 3D + crack.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.




Mon Jul 18 21:05:29 2005 => Total Objects Scanned: 101782
Mon Jul 18 21:05:29 2005 => Total Virus(es) Found: 30
Mon Jul 18 21:05:29 2005 => Total Disinfected Files: 0
Mon Jul 18 21:05:29 2005 => Total Files Renamed: 0
Mon Jul 18 21:05:29 2005 => Total Deleted Objects: 0
Mon Jul 18 21:05:29 2005 => Total Errors: 50
Mon Jul 18 21:05:29 2005 => Time Elapsed: 04:21:04
Mon Jul 18 21:05:29 2005 => Virus Database Date: 2005/06/24
Mon Jul 18 21:05:29 2005 => Virus Database Count: 136182


--------------------------------------------------------------------------


Und gleich noch mein HijackThis Log hinterher:


Logfile of HijackThis v1.99.1
Scan saved at 21:58:51, on 18.07.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Programme\ICQLite\ICQLite.exe
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Programme\Browser MOUSE\mouse32a.exe
C:\Programme\Office keyboard utility\1.4\OFFICEKB.exe
C:\Programme\D-Tools\daemon.exe
C:\Programme\Winamp\winampa.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\MSN Messenger\MsnMsgr.Exe
C:\Programme\TGTSoft\StyleXP\StyleXP.exe
C:\Programme\Office keyboard utility\1.4\MMKEYB.EXE
C:\Programme\Office keyboard utility\1.4\TrayMon.exe
C:\Programme\Office keyboard utility\1.4\osd.exe
C:\Programme\Office keyboard utility\1.4\nhksrv.exe
C:\Programme\AVPersonal\AVGUARD.EXE
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
G:\Dokumente und Einstellungen\Sebbo\Eigene Dateien\Sebastian\Setups & Updates\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programme\TGTSoft\StyleXP\TGT_BHO.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programme\Browser MOUSE\mouse32a.exe
O4 - HKLM\..\Run: [FLMOFFICEKEYBOARD] C:\Programme\Office keyboard utility\1.4\OFFICEKB.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142YYDE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1112811154078
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Programme\Gemeinsame Dateien\EPSON\EBAPI\SAgent2.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programme\Office keyboard utility\1.4\nhksrv.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programme\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Schöne Grüße Chibby
_____________
Anm.
Aktive Links editiert!
Beachte zukünftig die Hinweise dieser Anleitung: HiJackThis.


LG Cidre
S-Mod TB