Hab gestern dann einen eScan gemacht:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (1.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (2.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (3.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (1.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (2.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (3.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:30 2006 => Object "smitfraud Browser Hijacker" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\anwendungsdaten\hp\digital imaging\cache\1.dat
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\anwendungsdaten\hp\digital imaging\cache\2.dat
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\anwendungsdaten\hp\digital imaging\cache\3.dat
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\Anwendungsdaten\hp\digital imaging\cache\1.dat
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\Anwendungsdaten\hp\digital imaging\cache\2.dat
Mon Aug 07 04:57:29 2006 => Offending file found: C:\Dokumente und Einstellungen\Fabian\Lokale Einstellungen\Anwendungsdaten\hp\digital imaging\cache\3.dat
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
Mon Aug 07 08:11:25 2006 => File C:\RECYCLER\S-1-5-21-861567501-602162358-839522115-1004\Dc7.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.da". Action Taken: No Action Taken.
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
Mon Aug 07 04:57:30 2006 => Offending Folder found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\aol\c_aol 9.0\idb\bart\1024
~~~~~~~~~~~
Registry
~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Aug 07 08:33:02 2006 => Total Errors: 423
Mon Aug 07 08:33:02 2006 => Time Elapsed: 03:35:47
Mon Aug 07 08:33:02 2006 => Total Objects Scanned: 197047
Mon Aug 07 04:56:44 2006 => Virus Database Date: 8/5/2006
Mon Aug 07 08:33:02 2006 => Virus Database Date: 8/5/2006
Mon Aug 07 09:03:12 2006 => Virus Database Date: 8/5/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hallo,
gut, die ersten Einträge sind ein Fehlalarm, dieser Eintrag:

Mon Aug 07 04:57:30 2006 => Object "smitfraud Browser Hijacker" found in File System! Action Taken: No Action Taken.

wird ein Rest in der Registry von deiner Infektion sein, ist aber nicht weiter drammatisch, da er sich auf Dateien bezieht die längst gelöscht sind.

Der hier:

Mon Aug 07 08:11:25 2006 => File C:\RECYCLER\S-1-5-21-861567501-602162358-839522115-1004\Dc7.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.da". Action Taken: No Action Taken.

ist auch kein Problem, schalte die Systemwiederherstellung ab, boote neu und schalte sie wieder ein.

Die Logs von Datfind.bat und Silentrunners hätte ich trotzdem gerne noch, auch wenn alles danach aussieht als ob die Sache erledigt wäre.



Grüße Wildone

mOIn
und tschuldigung wenn ich dazwischen fahre aber die
Update.exe
könnte mit diesem Netzfund
http://www.castlecops.com/p804293-Up...requested.html
und mit dem Fund hier das es sich um Vundo handelt decken, oder ?
(ich meine das Vundo im System gefunden wird)
MFG

k, dann schau ich nochmal

system32:

07.08.2006 13:04 1.374 wpa.dbl
07.08.2006 13:04 48.883 vsconfig.xml
07.08.2006 13:03 62.201 nvapps.xml
07.08.2006 13:03 186.822 OODBS.lor
07.08.2006 04:02 496.915 aycdd.ini
07.08.2006 03:43 143 mcrh.tmp
07.08.2006 02:01 496.417 aycdd.bak2
06.08.2006 15:58 2.550 Uninstall.ico
06.08.2006 15:58 1.406 Help.ico
06.08.2006 15:58 30.590 pavas.ico
06.08.2006 15:51 0 asfiles.txt
06.08.2006 14:01 495.536 aycdd.bak1
03.08.2006 20:00 228.800 FNTCACHE.DAT
03.08.2006 06:43 4.704 KGyGaAvL.sys
03.08.2006 06:39 104 6718A16F9A.sys
31.07.2006 20:21 4.212 zllictbl.dat
12.07.2006 14:19 401.200 perfh009.dat
12.07.2006 14:19 415.800 perfh007.dat
12.07.2006 14:19 62.480 perfc009.dat
12.07.2006 14:19 75.194 perfc007.dat
12.07.2006 14:18 966.250 PerfStringBackup.INI
09.07.2006 13:42 392.824 vsdatant.sys
09.07.2006 13:42 83.960 zlcomm.dll
09.07.2006 13:42 71.672 zlcommdb.dll
09.07.2006 13:42 59.384 vswmi.dll
09.07.2006 13:42 100.344 vsxml.dll
09.07.2006 13:42 440.312 vsutil.dll
09.07.2006 13:42 71.672 vsregexp.dll
09.07.2006 13:42 104.440 vsmonapi.dll
09.07.2006 13:42 157.688 vsinit.dll
09.07.2006 13:42 268.280 vspubapi.dll
09.07.2006 13:42 83.960 vsdata.dll
07.07.2006 03:21 6.757.792 MRT.exe
06.07.2006 21:31 262.144 wrap_oal.dll

systemtemp:

07.08.2006 13:04 4 PMShared
07.08.2006 04:06 16.384 ~DF6CC7.tmp
07.08.2006 03:20 0 aax39.tmp
07.08.2006 02:30 717 control.xml
07.08.2006 01:32 0 aax52.tmp
07.08.2006 01:26 0 aax49.tmp
07.08.2006 01:25 0 aax48.tmp
07.08.2006 01:23 0 aax47.tmp
07.08.2006 01:22 0 aax46.tmp
07.08.2006 01:20 0 aax45.tmp
07.08.2006 00:47 59.769 ~K20065.jpg
07.08.2006 00:45 0 EPSLog.txt
07.08.2006 00:38 59.769 ~K20064.jpg
06.08.2006 20:07 0 aaxB.tmp
06.08.2006 20:05 0 aaxA.tmp
06.08.2006 18:10 16.384 ~DF939.tmp
06.08.2006 18:09 16.384 ~DFD58B.tmp
04.08.2006 05:24 288 EE6F7F28.TMP
03.08.2006 03:33 70 3EE68A68.TMP

system:

Datentr„ger in Laufwerk C: ist Maxtor 6L160M0 - Win XP
Volumeseriennummer: E02E-C58C

Verzeichnis von C:\WINDOWS

07.08.2006 13:04 192 win.ini
07.08.2006 13:04 0 0.log
07.08.2006 13:04 1.451.559 WindowsUpdate.log
07.08.2006 13:04 159 wiadebug.log
07.08.2006 13:03 50 wiaservc.log
07.08.2006 13:03 2.048 bootstat.dat
07.08.2006 04:56 50 Lic.xxx
07.08.2006 04:51 4.585.000 ntbtlog.txt
07.08.2006 04:14 32.536 SchedLgU.Txt
07.08.2006 02:30 184.138 wmsetup.log
07.08.2006 02:27 2.372 KB898549.log
07.08.2006 02:21 54.156 QTFont.qfn
07.08.2006 02:16 69 NeroDigital.ini
07.08.2006 01:59 0 system.ini
06.08.2006 15:58 32 pavsig.txt
06.08.2006 15:48 809.596 setupapi.log
06.08.2006 09:45 178.182 setupact.log
04.08.2006 11:24 1.409 QTFont.for
03.08.2006 06:46 341 beatbox.INI
03.08.2006 06:44 32.418 FontData.fdb
03.08.2006 01:28 0 musicmaker.INI
30.07.2006 02:17 433.967 DirectX.log
12.07.2006 13:24 23.536 ocmsn.log
12.07.2006 13:24 102.075 ntdtcsetup.log
12.07.2006 13:24 1.374 imsins.log
12.07.2006 13:24 169.842 comsetup.log
12.07.2006 13:24 11.796 KB917159.log
12.07.2006 13:24 234.107 tsoc.log
12.07.2006 13:24 94.341 iis6.log
12.07.2006 13:24 305.331 ocgen.log
12.07.2006 13:24 30.376 msgsocm.log
12.07.2006 13:24 597.567 FaxSetup.log
12.07.2006 13:24 12.309 KB914388.log
12.07.2006 13:24 1.374 imsins.BAK
12.07.2006 13:24 42.460 updspapi.log
12.07.2006 13:24 10.257 KB916595.log
08.07.2006 11:12 37 TemplateWizard.INI
07.07.2006 17:18 754 WORDPAD.INI

sys:

Datentr„ger in Laufwerk C: ist Maxtor 6L160M0 - Win XP
Volumeseriennummer: E02E-C58C

Verzeichnis von C:\

07.08.2006 13:15 0 sys.txt
07.08.2006 13:15 13.462 system.txt
07.08.2006 13:14 1.262 systemtemp.txt
07.08.2006 13:13 112.565 system32.txt
07.08.2006 13:05 2.939 eScan_neu.txt
07.08.2006 13:03 1.610.072.064 pagefile.sys
07.08.2006 08:33 0 23990098.$$$
07.08.2006 08:33 7 AVPCallback.log
07.08.2006 01:59 211 boot.ini
06.08.2006 23:40 768 VundoFix.txt
06.08.2006 13:42 3.478 eScan_neu_alt02.txt
06.08.2006 09:46 1.069 rapport.txt
06.08.2006 02:13 3.494 smitfiles.txt
05.08.2006 23:50 4.888 eScan_neu_alt01.txt
15.07.2006 15:53 77 FilterLog.log
08.07.2006 12:32 3.402 s3so.1
08.07.2006 11:48 3.402 s3h4
30.06.2006 19:01 0 error.txt


[EDIT]

Silentrunners:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
"{E02EC58C-08A3-1031-1201-050721050031}" = ""C:\Programme\Gemeinsame Dateien\{E02EC58C-08A3-1031-1201-050721050031}\Update.exe" mc-110-12-0000272" [null data]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Logitech Utility" = "Logi_MwX.Exe" ["Logitech Inc."]
"NVMixerTray" = ""C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"" ["NVIDIA Corporation"]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"NvMediaCenter" = "RunDLL32.exe NvMCTray.dll,NvTaskbarInit" [MS]
"!ewido" = ""C:\Programme\ewido anti-spyware 4.0\ewido.exe" /minimized" ["Anti-Malware Development a.s."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\found.004\dir0000.chk\SDHelper.dll" ["Safer Networking Limited"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {HKLM...CLSID} = "iTunes"
\InProcServer32\(Default) = "C:\Programme\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> {HKLM...CLSID} = "RealOne Player Context Menu Class"
\InProcServer32\(Default) = "C:\Programme\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]
"{429363AD-512D-4A7A-9C21-E5AACAECEABF}" = "Warsow_dqf_Player"
-> {HKLM...CLSID} = "ShellExt Class"
\InProcServer32\(Default) = "C:\Games\Programme\Warsow\War§owDemosPlayer.dll" [file not found]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {HKLM...CLSID} = "Portable Media Devices"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {HKLM...CLSID} = "Portable Media Devices Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\Audiodev.dll" [MS]
"{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
"{e82a2d71-5b2f-43a0-97b8-81be15854de8}" = "ShellLink for Application References"
-> {HKLM...CLSID} = "ShellLink for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}" = "Shell Icon Handler for Application References"
-> {HKLM...CLSID} = "Shell Icon Handler for Application References"
\InProcServer32\(Default) = "C:\WINDOWS\system32\dfshim.dll" [MS]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {HKLM...CLSID} = "Shell Search Band"
\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}" = "ICQ Lite Shell Extension"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
"{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class"
-> {HKLM...CLSID} = "DesktopContext Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer"
-> {HKLM...CLSID} = "Desktop Explorer"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu"
-> {HKLM...CLSID} = "nView Desktop Context Menu"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper"
-> {HKLM...CLSID} = "NVIDIA CPL Extension"
\InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "ewido anti-spyware 4.0"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\shellexecutehook.dll" ["Anti-Malware Development a.s."]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * OODBS" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! WgaLogon\DLLName = "WgaLogon.dll" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = ""C:\Programme\OpenOffice.org 2.0\program\shlxthdl.dll"" ["Sun Microsystems, Inc."]
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "C:\Programme\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido anti-spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-spyware 4.0\context.dll" ["Anti-Malware Development a.s."]
ICQLiteMenu\(Default) = "{73B24247-042E-4EF5-ADC2-42F62E6FD654}"
-> {HKLM...CLSID} = "MCLiteShellExt Class"
\InProcServer32\(Default) = "C:\Programme\ICQLite\ICQLiteShell.dll" [empty string]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Dokumente und Einstellungen\Fabian\Anwendungsdaten\IrfanView\IrfanView_Wallpaper.bmp"


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SYSTEMROOT%\system32\nvappfilter.dll ["NVIDIA"], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 27
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Real.com"
\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Konsole"
"CLSIDExtension" = "{CAFEEFAC-0015-0000-0005-ABCDEFFEDCBC}"
-> {HKLM...CLSID} = "Java Plug-in 1.5.0_05"
\InProcServer32\(Default) = "C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll" ["Sun Microsystems, Inc."]

{36ECAF82-3300-8F84-092E-AFF36D6C7040}\
"ButtonText" = "Run WinHTTrack"
"MenuText" = "Launch WinHTTrack"
"CLSIDExtension" = "{86529161-034E-4F8A-88D2-3C625E612E04}"
-> {HKLM...CLSID} = "WinHTTrackLauncher Class"
\InProcServer32\(Default) = "C:\Programme\WinHTTrack\WinHTTrackIEBar.dll" [null data]

{B863453A-26C3-4E1F-A54D-A2CD196348E9}\
"ButtonText" = "ICQ Lite"
"MenuText" = "ICQ Lite"
"Exec" = "C:\Programme\ICQLite\ICQLite.exe" ["ICQ Ltd."]

{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir PersonalEdition Classic Service, AntiVirService, "C:\Programme\AntiVir PersonalEdition Classic\avguard.exe" ["AVIRA GmbH"]
AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
AOL Connectivity Service, AOL ACS, ""C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe"" ["America Online, Inc."]
ewido anti-spyware 4.0 guard, ewido anti-spyware 4.0 guard, "C:\Programme\ewido anti-spyware 4.0\guard.exe" ["Anti-Malware Development a.s."]
NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
O&O Defrag, O&O Defrag, "C:\WINDOWS\system32\oodag.exe" ["O&O Software GmbH"]
SecuROM User Access Service (V7), UserAccess7, "C:\WINDOWS\system32\UAService7.exe" [null data]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
PDFCreator\Driver = "pdfcmnnt.dll" [null data]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 18 seconds, including 5 seconds for message boxes)

Hallo,
@nochdigger
Danke für die Info, war mir doch gleich suspekt, habe mich durch das ERbebnis von Virustotal vom richtigen Weg abbringen lassen.
@FaTD
Poste mal noch ein HijackThis Log, existiert die update.exe bei dir noch? Ist sie aktiv?

Edit
lösche noch folgende Dateien(System32 Ordner):
07.08.2006 04:02 496.915 aycdd.ini
07.08.2006 03:43 143 mcrh.tmp
07.08.2006 02:01 496.417 aycdd.bak2
06.08.2006 14:01 495.536 aycdd.bak1

Silentrunners sieht bis auf die update.exe sauber aus.

Grüße Wildone

Zitat von Wildone

@FaTD
Poste mal noch ein HijackThis Log, existiert die update.exe bei dir noch? Ist sie aktiv?


Grüße Wildone

HiJackLog:

Logfile of HijackThis v1.99.1
Scan saved at 13:20:12, on 07.08.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Programme\ewido anti-spyware 4.0\ewido.exe
C:\Programme\Gemeinsame Dateien\{E02EC58C-08A3-1031-1201-050721050031}\Update.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Programme\Alcatel\SpeedTouch USB\dragdiag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programme\AOL 9.0\waol.exe
C:\Programme\AOL 9.0\shellmon.exe
C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Fabian\Desktop\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\found.004\dir0000.chk\SDHelper.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "C:\Programme\ewido anti-spyware 4.0\ewido.exe" /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - h**p://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - h**p://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.0.69.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126452590406
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - h**p://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7933472A-BD75-45F5-BAC7-FDEDBE4E2D2F}: NameServer = 205.188.146.145
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: app_filter - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe




Der Ordner in dem die update.exe und noch eine *.dll Datei waren, hab ich während ich im abgesicherten Modus war gelöscht.

Hallo,

Der Ordner in dem die update.exe und noch eine *.dll Datei waren, hab ich während ich im abgesicherten Modus war gelöscht.

Irgendwie nicht:

C:\Programme\Gemeinsame Dateien\{E02EC58C-08A3-1031-1201-050721050031}\Update.exe

versuche das ganze nochmal den Ordner mit killbox on reboot zu löschenund poste danach ein weiteres HijackThis Log.


Grüße Wildone

Das mit Killbox werd ich gleich machen, aber was soll ich machen wenn meine Systemwiederherstellung schon ausgeschaltet ist (hat mich oft genervt, deswegen habe ich die vor einiger Zeit ausgeschaltet)?

Hallo,
ach ich bin ja doof, die hing gar nicht in der Systemwiederherstellung sondern im Mülleimer, also einfach diesen leeren.


Grüße Wildone

K, hab ich gemacht.

HiJackLog:

Logfile of HijackThis v1.99.1
Scan saved at 13:33:52, on 07.08.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Programme\ewido anti-spyware 4.0\ewido.exe
C:\Programme\Logitech\MouseWare\system\em_exec.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Fabian\Desktop\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\found.004\dir0000.chk\SDHelper.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "C:\Programme\ewido anti-spyware 4.0\ewido.exe" /minimized
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.0.69.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126452590406
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe
O23 - Service: app_filter - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe (file missing)
O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hallo,
jetzt sieht es wirklich sauber aus, wenn sich wider Erwarten die update.exe noch mal wiederherstellen sollte meldest du dich nochmal, ansonsten war die Geburt (oder um genau zu sein die Austreibung) ja schwer genug, ich hoffe du hast deine Lektion wie man mit Dateien aus dubiosen Quellen umgeht nun gelernt.


Grüße Wildone

Ja, hab ich auf jedenfall.

Also danke, danke und danke!:aplaus: :aplaus:



Werd eScan zur Sicherheit zwar nochmal laufen lassen aber ich denke/hoffe das es das jetzt war.

Hallo,

bin's jetzt doch nochmal.

Zitat von FaTD

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (1.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (2.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (3.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (1.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (2.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:29 2006 => System found infected with wareout Adware (3.dat)! Action taken: No Action Taken.
Mon Aug 07 04:57:30 2006 => Object "smitfraud Browser Hijacker" found in File System! Action Taken: No Action Taken.

Sind das die Fehlalarme von denen du geschrieben hast? Weil die wurden auch jetzt beim eScan gefunden(wenn ja, krieg ich das irgendwie weg?)

Hallo,
wie schon oben gepostet die ersten fünf sind Fehlalarme, die Dateien gehören zu einem Programm von hp.
Der letzte Eintrag weist wohl auf einen Registryeintrag hin der noch vorhanden ist, leider wird dieser nicht genannt, ist aber nicht so dramatisch, da er ohne die entsprechenden Dateien keinen Schaden anrichten kann.


Grüße Wildone