Hallo zusammen ,

also hab folgendes Problem:
1.
wenn ich auf h**p://www.google.de geh und dort suche werde ich weiter geleitet nach h**p://wwwgoogle.de .... ich bekoms einfach nicht weg!
Bild:http://web49.bces-2090.de/google.JPG

2.
Alle sharing seiten und crack seiten wie: h**p://www.torrent.to und h**tp://www.gamecopyworld.de werden blockiert !
Bilder: http://web49.bces-2090.de/gamecopyworld.JPG
http://web49.bces-2090.de/torrent.JPG

HILFE! ^^

Poste zunächst einen Hijackthis-Log

Logfile of HijackThis v1.99.1
Scan saved at 17:59:09, on 26.10.2005
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\MSN Messenger\msnmsgr.exe
c:\programme\valve\steam\steam.exe
C:\WINDOWS\SysWOW64\ctfmon.exe
C:\Program Files (x86)\Microsoft Lernen und Wissen\Microsoft Lernen und Wissen 2006 DVD\EDICT.EXE
C:\Program Files (x86)\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files (x86)\No-IP\DUC20.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files (x86)\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files (x86)\ISTsvc\istsvc.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Programme\eMule\emule.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R3 - URLSearchHook: (no name) - _{855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
F2 - REG:system.ini: UserInit=userinit
O1 - Hosts: 195.158.172.121 w*w.file-webber.de
O1 - Hosts: 195.158.172.121 file-webber.de
O1 - Hosts: 195.158.172.121 www-google.ae
O1 - Hosts: 195.158.172.121 www-google.as
O1 - Hosts: 195.158.172.121 www-google.at
O1 - Hosts: 195.158.172.121 www-google.au
O1 - Hosts: 195.158.172.121 www-google.bi
O1 - Hosts: 195.158.172.121 www-google.br
O1 - Hosts: 195.158.172.121 www-google.ca
O1 - Hosts: 195.158.172.121 www-google.cc
O1 - Hosts: 195.158.172.121 www-google.cd
O1 - Hosts: 195.158.172.121 www-google.cg
O1 - Hosts: 195.158.172.121 www-google.ch
O1 - Hosts: 195.158.172.121 www-google.cl
O1 - Hosts: 195.158.172.121 www-google.co.cr
O1 - Hosts: 195.158.172.121 www-google.co.gg
O1 - Hosts: 195.158.172.121 www-google.co.hu
O1 - Hosts: 195.158.172.121 www-google.co.il
O1 - Hosts: 195.158.172.121 www-google.co.in
O1 - Hosts: 195.158.172.121 www-google.co.je
O1 - Hosts: 195.158.172.121 www-google.co.jp
O1 - Hosts: 195.158.172.121 www-google.co.kr
O1 - Hosts: 195.158.172.121 www-google.co.ls
O1 - Hosts: 195.158.172.121 www-google.co.nz
O1 - Hosts: 195.158.172.121 www-google.com
O1 - Hosts: 195.158.172.121 www-google.com.ae
O1 - Hosts: 195.158.172.121 www-google.com.au
O1 - Hosts: 195.158.172.121 www-google.com.ca
O1 - Hosts: 195.158.172.121 www-google.com.do
O1 - Hosts: 195.158.172.121 www-google.com.fj
O1 - Hosts: 195.158.172.121 www-google.com.gr
O1 - Hosts: 195.158.172.121 www-google.com.ly
O1 - Hosts: 195.158.172.121 www-google.com.mt
O1 - Hosts: 195.158.172.121 www-google.com.my
O1 - Hosts: 195.158.172.121 www-google.com.nf
O1 - Hosts: 195.158.172.121 www-google.com.ni
O1 - Hosts: 195.158.172.121 www-google.com.pa
O1 - Hosts: 195.158.172.121 www-google.com.pe
O1 - Hosts: 195.158.172.121 www-google.com.pk
O1 - Hosts: 195.158.172.121 www-google.com.pr
O1 - Hosts: 195.158.172.121 www-google.com.py
O1 - Hosts: 195.158.172.121 www-google.com.ru
O1 - Hosts: 195.158.172.121 www-google.com.sg
O1 - Hosts: 195.158.172.121 www-google.com.sv
O1 - Hosts: 195.158.172.121 www-google.com.tr
O1 - Hosts: 195.158.172.121 www-google.com.tw
O1 - Hosts: 195.158.172.121 www-google.com.vc
O1 - Hosts: 195.158.172.121 www-google.com.vn
O1 - Hosts: 195.158.172.121 www-google.cr
O1 - Hosts: 195.158.172.121 www-google.de
O1 - Hosts: 195.158.172.121 www-google.dj
O1 - Hosts: 195.158.172.121 www-google.do
O1 - Hosts: 195.158.172.121 www-google.es
O1 - Hosts: 195.158.172.121 www-google.fj
O1 - Hosts: 195.158.172.121 www-google.fr
O1 - Hosts: 195.158.172.121 www-google.gg
O1 - Hosts: 195.158.172.121 www-google.gl
O1 - Hosts: 195.158.172.121 www-google.gm
O1 - Hosts: 195.158.172.121 www-google.gr
O1 - Hosts: 195.158.172.121 www-google.hn
O1 - Hosts: 195.158.172.121 www-google.hu
O1 - Hosts: 195.158.172.121 www-google.ie
O1 - Hosts: 195.158.172.121 www-google.il
O1 - Hosts: 195.158.172.121 www-google.in
O1 - Hosts: 195.158.172.121 www-google.it
O1 - Hosts: 195.158.172.121 www-google.je
O1 - Hosts: 195.158.172.121 www-google.jp
O1 - Hosts: 195.158.172.121 www-google.kr
O1 - Hosts: 195.158.172.121 www-google.kz
O1 - Hosts: 195.158.172.121 www-google.ls
O1 - Hosts: 195.158.172.121 www-google.lt
O1 - Hosts: 195.158.172.121 www-google.lu
O1 - Hosts: 195.158.172.121 www-google.lv
O1 - Hosts: 195.158.172.121 www-google.ly
O1 - Hosts: 195.158.172.121 www-google.mt
O1 - Hosts: 195.158.172.121 www-google.mu
O1 - Hosts: 195.158.172.121 www-google.mw
O1 - Hosts: 195.158.172.121 www-google.my
O1 - Hosts: 195.158.172.121 www-google.nf
O1 - Hosts: 195.158.172.121 www-google.ni
O1 - Hosts: 195.158.172.121 www-google.nl
O1 - Hosts: 195.158.172.121 www-google.nz
O1 - Hosts: 195.158.172.121 www-google.pa
O1 - Hosts: 195.158.172.121 www-google.pe
O1 - Hosts: 195.158.172.121 www-google.pk
O1 - Hosts: 195.158.172.121 www-google.pl
O1 - Hosts: 195.158.172.121 www-google.pn
O1 - Hosts: 195.158.172.121 www-google.pr
O1 - Hosts: 195.158.172.121 www-google.pt
O1 - Hosts: 195.158.172.121 www-google.py
O1 - Hosts: 195.158.172.121 www-google.ru
O1 - Hosts: 195.158.172.121 www-google.rw
O1 - Hosts: 195.158.172.121 www-google.se
O1 - Hosts: 195.158.172.121 www-google.sg
O1 - Hosts: 195.158.172.121 www-google.sh
O1 - Hosts: 195.158.172.121 www-google.sk
O1 - Hosts: 195.158.172.121 www-google.sm
O1 - Hosts: 195.158.172.121 www-google.sv
O1 - Hosts: 195.158.172.121 www-google.td
O1 - Hosts: 195.158.172.121 www-google.tr
O1 - Hosts: 195.158.172.121 www-google.tw
O2 - BHO: Hilfsobjekt für Encarta Web-Begleiter - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files (x86)\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Encarta Web-Begleiter - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files (x86)\Common Files\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Program Files (x86)\NVIDIA Corporation\nTune\\nTune.exe" clear
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.5.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [shell32] C:\WINDOWS\SysWow64\wuauclt10.exe
O4 - HKLM\..\Run: [Client Server Runtime Process] C:\WINDOWS\SysWow64\smmss.exe
O4 - HKLM\..\Run: [Windows update] C:\WINDOWS\SysWow64\wudupdate.exe
O4 - HKLM\..\Run: [I downloaded pirated Software from P2P and now I post my Hijack log whining] C:\WINDOWS\SysWow64\Black and White 2 crack.exe <<o0 hört sich ja nich gut an [ naja hat aber auch nix gebracht O-o ]
O4 - HKLM\..\Run: [IST Service] "C:\Program Files (x86)\ISTsvc\istsvc.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\programme\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [L06DXLRD_4223093] "C:\Program Files (x86)\Microsoft Lernen und Wissen\Microsoft Lernen und Wissen 2006 DVD\EDICT.EXE" -m
O4 - Startup: No-IP DUC.lnk = C:\Program Files (x86)\No-IP\DUC20.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files (x86)\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files (x86)\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SysWow64\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - h**p://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FD5584F5-340F-4F40-A648-9517CFE3D788}: NameServer = 192.168.0.1
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Virtual CD v7 Management Service (VC7SecS) - Unknown owner - C:\Program Files (x86)\HHVcdV7Sys\VC7SecS.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

Nun ja, das liest sich ja mehr als bedenklich.
Ob eine Bereinigung hier überhaupt noch Sinn macht, erfahren wir nachdem du dein System mit Escan untersucht und uns die Ergebnisse mitgeteilt hast.
Obwohl ich hier eigentlich eher dazu tendieren würde das System zu plätten, neuaufzuspielen und vor der I-Netverbindung vernünftig abzusichern, da hier doch einiges im argen liegt.
Falls du dich für letztgenanntes entscheiden solltest hier mal ein Link:

http://www.trojaner-board.de/showthread.php?t=12154

so schlimm OO

Sieht tatsächlich nicht gut aus!

hm naja... Danke system werde ich auf keinen fall neu drauf machen .. dazu bräuchte ich endloss viel cds zum sichern der daten und .. dann wen ich neuinstalliert habe und die wieda drauf mache is so oder so wieder verseucht =). hat also kein sinn =) werd ich mich mit meinen pc solange beschäftigen bis er den geist auf gibt :P

Du kannst ja tatsächlich erstmal den Escan wie beschrieben durchführen.Mach dir aber nicht allzuviel Hoffnungen.

ich finde den log ein bisschen gross um den hier hin zu posten oO
[ausserdem steht da nur drinn was der gescannt hat also jede datei meiens systems mehr nicht ] und das mit der find.bat wen ich darauf doppelklcikce da passiert nix ...

In der Anleitung steht dazu folgendes:

2. Möglichkeit: Wenn du unsicher bist, dann solltest du einen neuen Thread eröffnen und uns die 'Virus Log Information' [5] zur Verfügung stellen, damit wir dein System analysieren können. Gehe wie folgt vor:

[5] Rechtsklick auf die find.rar -> Ziel speichern unter… z.B. 'C:\Find.rar' -> 'Find.rar' entpacken z.B. 'C:\Find.bat' -> 'Find.bat' doppelklicken und den Scan abwarten -> den Inhalt [6] der automatisch erstellten 'C:\eScan_neu.txt' posten.

Wenn das nicht klappt:

Alternativ:
Öffne die 'mwav.log' im Ordner 'C:\Bases_X' -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.

ACH DOCH GESCHAFFT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Oct 26 20:31:43 2005 => File C:\WINDOWS\SysWow64\wudupdate.exe infected by "Trojan-Downloader.Win32.IstBar.lq" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:31:43 2005 => File C:\PROGRA~3\ISTsvc\istsvc.exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:31:49 2005 => System found infected with cws.loadadv.400 Browser Hijacker ({5e2121ee-0300-11d4-8d3b-444553540000})! Action taken: No Action Taken.
Wed Oct 26 20:31:49 2005 => System found infected with istbar Spyware/Adware ({10e42047-deb9-4535-a118-b3f6ec39b807})! Action taken: No Action Taken.
Wed Oct 26 20:31:51 2005 => System found infected with downloadplus Spyware/Adware (installer.exe)! Action taken: No Action Taken.
Wed Oct 26 20:31:51 2005 => System found infected with sahagent Spyware/Adware (ucmoreiex.exe)! Action taken: No Action Taken.
Wed Oct 26 20:31:51 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken.
Wed Oct 26 20:31:53 2005 => System found infected with cydoor.topicks.a Spyware/Adware (settings.dat)! Action taken: No Action Taken.
Wed Oct 26 20:31:55 2005 => System found infected with redv Spyware/Adware (insthelp.dll)! Action taken: No Action Taken.
Wed Oct 26 20:31:55 2005 => System found infected with coulomb dialer Spyware/Adware (loader.exe)! Action taken: No Action Taken.
Wed Oct 26 20:31:55 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
Wed Oct 26 20:31:55 2005 => System found infected with whenu.savenow Spyware/Adware (adswrapper[1].js)! Action taken: No Action Taken.
Wed Oct 26 20:31:56 2005 => System found infected with whenu.savenow Spyware/Adware (adsend[1].js)! Action taken: No Action Taken.
Wed Oct 26 20:31:56 2005 => System found infected with whenu.savenow Spyware/Adware (adswrapper[1].js)! Action taken: No Action Taken.
Wed Oct 26 20:31:56 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Wed Oct 26 20:31:56 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken.
Wed Oct 26 20:32:11 2005 => File C:\113_dollarrevenue_4_0_3_9.exe infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:33:00 2005 => File C:\contextplus.exe infected by "Trojan.Win32.Crypt.t" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:33:58 2005 => File C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-627689b0.zip infected by "Trojan-Downloader.Java.OpenStream.w" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:33:58 2005 => File C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-3ebb9e9e.zip infected by "Trojan-Downloader.Java.OpenStream.w" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:34:22 2005 => File C:\Documents and Settings\Administrator\Local Settings\Temp\GLF9D1GLF9D1.EXE infected by "Trojan-Downloader.Win32.TSUpdate.j" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:47:04 2005 => File C:\Downloads\activation crack all microsoft windows xp home edition\start.exe infected by "Trojan-Downloader.Win32.IstBar.is" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:47:04 2005 => File C:\Downloads\activation crack all microsoft windows xp home edition.zip infected by "Trojan-Downloader.Win32.IstBar.is" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:51:13 2005 => File C:\Downloads\Black.And.White.2.GENERIC.READNFO_KEYGEN-FFF.exe infected by "Trojan-Downloader.Win32.Adload.j" Virus! Action Taken: No Action Taken.
Wed Oct 26 20:57:57 2005 => File C:\drin.exe infected by "Trojan-Downloader.Win32.Small.bke" Virus! Action Taken: No Action Taken.
Wed Oct 26 22:01:02 2005 => File C:\WINDOWS\system32\wudupdate.exe infected by "Trojan-Downloader.Win32.IstBar.lq" Virus! Action Taken: No Action Taken.
Wed Oct 26 22:02:23 2005 => File C:\ysbinstall_1003585.exe infected by "Trojan-Downloader.Win32.IstBar.is" Virus! Action Taken: No Action Taken.
Wed Oct 26 22:02:23 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Oct 26 20:31:43 2005 => File C:\WINDOWS\SysWow64\smmss.exe tagged as "not-a-virus:AdWare.Win32.EZula.bg". Action Taken: No Action Taken.
Wed Oct 26 20:31:43 2005 => File C:\PROGRA~3\SURFAC~1\SAcc.exe tagged as "not-a-virus:AdWare.Win32.SurfAccuracy.d". Action Taken: No Action Taken.
Wed Oct 26 20:34:19 2005 => File C:\Documents and Settings\Administrator\Local Settings\Temp\cmdinst.exe tagged as "not-a-virus:AdWare.Win32.CommAd.a". Action Taken: No Action Taken.
Wed Oct 26 20:34:35 2005 => File C:\Documents and Settings\Administrator\Local Settings\Temp\upd.exe tagged as not-a-virus:RiskTool.Win32.PsKill.1101. No Action Taken.
Wed Oct 26 20:44:56 2005 => File C:\Downloads\050404_girc435\girc435.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:44:57 2005 => File C:\Downloads\050404_girc435.zip tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:44:58 2005 => File C:\Downloads\050519_G-Scriptv3.2\G-Scriptv3.2\G-Scriptv3.2\mircG32.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:45:00 2005 => File C:\Downloads\050519_G-Scriptv3.2\G-Scriptv3.2.rar tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:45:00 2005 => File C:\Downloads\050519_G-Scriptv3.2.zip tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:45:01 2005 => File C:\Downloads\050711_loona\loona.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:45:02 2005 => File C:\Downloads\050711_loona.zip tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:52:26 2005 => File C:\Downloads\G-Scriptv3.3.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:52:59 2005 => File C:\Downloads\Invincible\Invincible\mIRC.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.612. No Action Taken.
Wed Oct 26 20:53:47 2005 => File C:\Downloads\Invincible.zip tagged as not-a-virus:Client-IRC.Win32.mIRC.612. No Action Taken.
Wed Oct 26 20:54:08 2005 => File C:\Downloads\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:54:08 2005 => File C:\Downloads\mirc616.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 20:57:59 2005 => File C:\installer.exe tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
Wed Oct 26 20:57:59 2005 => File C:\mte3ndi6odoxng.exe tagged as "not-a-virus:AdWare.Win32.ISearch.d". Action Taken: No Action Taken.
Wed Oct 26 21:01:03 2005 => File C:\Program Files\Media Access\MediaAccC.dll tagged as "not-a-virus:AdWare.Win32.WinAD.av". Action Taken: No Action Taken.
Wed Oct 26 21:27:13 2005 => File C:\Program Files (x86)\Mozilla Firefox\plugins\npzango.dll tagged as "not-a-virus:AdWare.Win32.WinAD.aw". Action Taken: No Action Taken.
Wed Oct 26 21:32:49 2005 => File C:\Programme\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.612. No Action Taken.
Wed Oct 26 21:32:49 2005 => File C:\Programme\mIRC\mircG32.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.616. No Action Taken.
Wed Oct 26 21:48:51 2005 => File C:\ucmoreiex.exe tagged as "not-a-virus:AdWare.Win32.Ucmore.a". Action Taken: No Action Taken.
Wed Oct 26 22:00:43 2005 => File C:\WINDOWS\system32\smmss.exe tagged as "not-a-virus:AdWare.Win32.EZula.bg". Action Taken: No Action Taken.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\istsvc !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\sacc !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\istsvc !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\kazaa !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\media access !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKLM\Software\sacc !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKCU\Software\imesh !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKCU\Software\ist !!!
Wed Oct 26 20:31:50 2005 => Offending Key found: HKCU\Software\kazaa !!!
Wed Oct 26 20:31:50 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\Run: ist service !!!
Wed Oct 26 20:31:50 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\Run: surfaccuracy !!!
Wed Oct 26 20:31:51 2005 => Offending file found: C:\installer.exe
Wed Oct 26 20:31:51 2005 => Offending file found: C:\ucmoreiex.exe
Wed Oct 26 20:31:51 2005 => Offending Folder found: C:\Program Files (x86)\istsvc
Wed Oct 26 20:31:51 2005 => Offending Folder found: C:\Program Files (x86)\surfaccuracy
Wed Oct 26 20:31:51 2005 => Offending file found: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\insthelp.dll
Wed Oct 26 20:31:53 2005 => Offending file found: C:\Documents and Settings\Administrator\Application Data\utorrent\settings.dat
Wed Oct 26 20:31:55 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\temp\insthelp.dll
Wed Oct 26 20:31:55 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\temp\netware\server\nw41x\loader.exe
Wed Oct 26 20:31:55 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\temporary internet files\content.ie5\675y1f8k\adsend[1].js
Wed Oct 26 20:31:55 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\temporary internet files\content.ie5\w1er0x67\adswrapper[1].js
Wed Oct 26 20:31:56 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\content.ie5\675y1f8k\adsend[1].js
Wed Oct 26 20:31:56 2005 => Offending file found: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\content.ie5\w1er0x67\adswrapper[1].js
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Oct 26 22:02:23 2005 => Total Virus(es) Found: 64
Wed Oct 26 22:02:23 2005 => Total Errors: 430
Wed Oct 26 22:02:23 2005 => Time Elapsed: 01:30:38
Wed Oct 26 22:02:23 2005 => Total Objects Scanned: 100715
Wed Oct 26 20:29:58 2005 => Virus Database Date: 2005/10/21
Wed Oct 26 22:02:23 2005 => Virus Database Date: 2005/10/21
Wed Oct 26 22:02:28 2005 => Virus Database Date: 2005/10/21
Wed Oct 26 22:16:58 2005 => Virus Database Date: 2005/10/21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~

also ich nehme ma an die infizierten dateien kann ich alle löschen oO.... oder sind da wichtige systemdateien bei

Zitat von shury0ka

hm naja... Danke system werde ich auf keinen fall neu drauf machen .. dazu bräuchte ich endloss viel cds zum sichern der daten und .. dann wen ich neuinstalliert habe und die wieda drauf mache is so oder so wieder verseucht =). hat also kein sinn =) werd ich mich mit meinen pc solange beschäftigen bis er den geist auf gibt :P

Sorry, aber bei der Einstellung schwindet (sicherlich nicht nur bei mir) die Lust ernsthaft zu helfen...

BTW: Ist dieser 'lustige' Beitragvon Dir hinzugefügt worden, oder wurde das von HJT so ausgeworfen?

O4 - HKLM\..\Run: [I downloaded pirated Software from P2P and now I post my Hijack log whining] C:\WINDOWS\SysWow64\Black and White 2 crack.exe

@ Lutz

O4 - HKLM\..\Run: [I downloaded pirated Software from P2P and now I post my Hijack log whining]

Das ist ein Eintrag, der derzeit öfters vorkommt-das ist Original HJT!