| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: escan logfile...bitte mal schauen...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.09.2005, 18:35
| #1 |
| |  escan logfile...bitte mal schauen... Hallo, seit ein paar tagen startet mein pc von alleine neu...und wenn ich auf irgendwelche fenster klicke, macht er die nur ne viertelsekunde auf und schließt sie sofort wieder. nun, da dachte ich mir ich untersuch ihn mal einwenig. wär nur klasse wenn ich davon auch ahnung hätte. nunja...habs also hijackthis mal durchlaufen lassen...und dann escan. nun zu meiner frage kann mir bitte jemand nähere auskunft zu meinem mwav.log geben? Sat Sep 24 17:32:57 2005 => System found infected with bearshare Spyware/Adware ({558ec983-bedb-9168-b2de-31dbf0ee543e})! Action taken: No Action Taken. Sat Sep 24 17:33:01 2005 => Offending value found in HKLM\Software\magnet\handlers\bearshare !!! Sat Sep 24 17:33:01 2005 => Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Sep 24 17:33:01 2005 => Offending value found in HKLM\Software\Licenses !!! Sat Sep 24 17:33:01 2005 => Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Sep 24 17:33:01 2005 => Offending value found in HKLM\Software\Licenses !!! Sat Sep 24 17:33:01 2005 => Object "bearshare Spyware/Adware" found in File System! Action Taken: No Action Taken. Sat Sep 24 17:33:19 2005 => Offending file found: C:\WINDOWS\iun6002.exe Sat Sep 24 17:33:19 2005 => System found infected with zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe)! Action taken: No Action Taken. Sat Sep 24 17:33:29 2005 => ***** Scanning Registry for errors created because of Adware/Spyware ***** Sat Sep 24 17:33:30 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\DIMM.DLL". Action Taken: No Action Taken. Sat Sep 24 17:33:30 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Programme\InterVideo\Common\Bin\IVIPromotion.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:30 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Ahead\NeroDigital\settings.xml". Action Taken: No Action Taken. Sat Sep 24 17:33:31 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\LBTKA.EXE" refers to invalid object "". Action Taken: No Action Taken. Sat Sep 24 17:33:32 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Adobe\Acrobat 6.0\TempIccProfiles\". Action Taken: No Action Taken. Sat Sep 24 17:33:32 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Adobe\Acrobat 6.0\TempIccProfiles\Non-Recommended\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Nokia\Nokia PC Suite 5\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Nokia\Nokia PC Suite 5\Lang\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Gemeinsame Dateien\Nokia\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Nokia\Nokia PC Suite 5\Components\PhoneBrowserComponents\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Nokia\Nokia PC Suite 5\Components\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Nokia\Nokia PC Suite 5\Components\PhoneBrowserComponents\Lang\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Gemeinsame Dateien\Nokia\MPDB40\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TMPGEnc\TMPGEnc 3.0 XPress\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\TMPGEnc\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Eidos Interactive\TRAOD\". Action Taken: No Action Taken. Sat Sep 24 17:33:33 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Programme\Eidos Interactive\". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "InstallShield_{93656878-FF8B-4935-99BB-F3F260037C57}". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "IrfanView". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "IsoBuster_is1". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KoolPlaya". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7B63B2922B174135AFC0E1377DD81EC2}". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{8ADFC4160D694100B5B8A22DE9DCABD9}". Action Taken: No Action Taken. Sat Sep 24 17:33:34 2005 => Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{A4D7B764-4140-11D4-88EB-0050DA3579C0}". Action Taken: No Action Taken. Sat Sep 24 17:33:37 2005 => Entry "HKCR\CLSID\{86FC1FD1-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "E:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken. Sat Sep 24 17:33:37 2005 => Entry "HKCR\CLSID\{86FC1FD3-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "E:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken. Sat Sep 24 17:33:38 2005 => Entry "HKCR\CLSID\{FACF11A2-5095-11D3-A9DE-00C0268E5C48}" refers to invalid object "E:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken. Sat Sep 24 17:33:38 2005 => Entry "HKCR\TypeLib\{0CEBAFA2-A5F8-11D1-B76F-58BB04C10000}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:38 2005 => Entry "HKCR\TypeLib\{1257CD33-90D0-11D1-A197-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{143C9CF1-E3E7-11D1-A1D2-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{19362773-E965-11D1-A1F0-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{3E895E71-0C27-11D2-A212-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{67800A63-C222-11D1-A1B3-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{86FC1FC2-BCF3-11D1-B76F-58BB04C10000}" refers to invalid object "E:\RUNTIME\mDxEmul.mom". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{9F3595E2-B5CC-11D1-B76F-58BB04C10000}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{9FD46A24-F9E8-11D1-A204-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{C8E100B3-6D59-11D1-A181-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:39 2005 => Entry "HKCR\TypeLib\{FD6E3405-67CB-11D1-A17E-080009AB3411}" refers to invalid object "E:\RUNTIME\Md8Rntm.exe". Action Taken: No Action Taken. Sat Sep 24 17:33:40 2005 => Entry "HKCR\.pcb" refers to invalid object "PCBFile". Action Taken: No Action Taken. Sat Sep 24 17:33:40 2005 => Entry "HKCR\.xmd" refers to invalid object "xmd". Action Taken: No Action Taken. Sat Sep 24 17:33:40 2005 => Entry "HKCR\DSP.DSP" refers to invalid object "{9C123EA9-AEC9-4f75-BBC0-7565FA1398966}". Action Taken: No Action Taken. Sat Sep 24 17:33:40 2005 => Entry "HKCR\DSP.DSPDMOProp_Chorus.1" refers to invalid object "{6F63B172-5543-4593-91CE-EDBA65B9FACDB}". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\Kavvlg.Kavvlg" refers to invalid object "{5A61B58E-2B0A-4B67-A882-FFC6FEAF12EE}". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\Kavvlg.Kavvlg.1" refers to invalid object "{5A61B58E-2B0A-4B67-A882-FFC6FEAF12EE}". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\KoolPlayaFile\shell\open\command" refers to invalid object "E:\Koolplaya.exe "%1"". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Sat Sep 24 17:33:41 2005 => Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Sat Sep 24 17:33:42 2005 => Entry "HKCR\RECORDING.RecordingCtrl.1" refers to invalid object "{42A3A9AB-F7B4-40B1-B2AA-F31E35459D4A}". Action Taken: No Action Taken. achja, und was ist zipitpro Spyware/Adware (C:\WINDOWS\iun6002.exe) genau? wo fängt man sich denn so wat ein? vielen dank im voraus... |
| Themen zu escan logfile...bitte mal schauen... |
| acrobat, adobe, c:\windows, components, dateien, einstellungen, escan, file, found, hijack, hijackthis, infected, klicke, m.exe, microsoft, object, programme, registry, scanning, shell, software, startet, suite, system, system32, version, windows |
Baum-Darstellung