Hi zusammen, meine Tochter hat mir gestern Ihren PC übberreicht mit der Mitteilung,das Sie nicht mehr ins Netz kommt.http://www.trojaner-board.de/images/smilies/aplaus.gif
:aplaus:
Ein Scann brachte unter anderem den Virus "Win32:Warezov-AAV" an etlichen Stellen zu Tage. Ausserdem ist die Firewall geblockt. Hie die Hijack-Log:
Logfile of HijackThis v1.99.1
Scan saved at 07:43:02, on 14.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\avmwlanstick\wlangui.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\bin32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\Programme\avmwlanstick\WlanNetService.exe
C:\WINDOWS\system32\isrprov.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOKUME~1\Lisa\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] REM C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] REM RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] REM RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] REM CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] REM "C:\Programme\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] REM "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [QlbCtrl] REM %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] REM C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [wmvdiag] REM C:\WINDOWS\system32\wmvconf.exe
O4 - HKLM\..\Run: [bin32.exe] C:\WINDOWS\bin32.exe s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google-Suche - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://C:\Programme\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
O20 - AppInit_DLLs: ccfgwshb.dll e1.dll
O20 - Winlogon Notify: libdprin - C:\WINDOWS\system32\libdprin.dll (file missing)
O20 - Winlogon Notify: mprwanp - C:\WINDOWS\system32\mprwanp.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O20 - Winlogon Notify: wmvmgr - wmvmgr32.dll (file missing)
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe

Vielleicht hilft auch die Log von Avast noch:
18.01.2007 18:14:50 1169140490 SYSTEM 988 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
18.01.2007 18:14:50 1169140490 SYSTEM 988 An error has occured while attempting to update. Please check the logs.
19.01.2007 17:17:59 1169223479 Lisa 336 Function setifaceUpdatePackages() has failed. Return code is 0x40010004, dwRes is 40010004.
20.01.2007 12:25:47 1169292347 SYSTEM 992 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
20.01.2007 12:25:48 1169292348 SYSTEM 992 An error has occured while attempting to update. Please check the logs.
21.01.2007 17:49:07 1169398147 SYSTEM 1008 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
21.01.2007 17:49:08 1169398148 SYSTEM 1008 An error has occured while attempting to update. Please check the logs.
22.01.2007 19:59:10 1169492350 SYSTEM 948 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
22.01.2007 19:59:11 1169492351 SYSTEM 948 An error has occured while attempting to update. Please check the logs.
23.01.2007 19:43:21 1169577801 SYSTEM 972 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
23.01.2007 19:43:22 1169577802 SYSTEM 972 An error has occured while attempting to update. Please check the logs.
24.01.2007 19:02:58 1169661778 SYSTEM 1012 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
24.01.2007 19:02:59 1169661779 SYSTEM 1012 An error has occured while attempting to update. Please check the logs.
25.01.2007 17:31:43 1169742703 SYSTEM 1064 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
25.01.2007 17:31:43 1169742703 SYSTEM 1064 An error has occured while attempting to update. Please check the logs.
26.01.2007 17:29:41 1169828981 SYSTEM 1008 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
26.01.2007 18:30:39 1169832639 SYSTEM 1008 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
27.01.2007 12:35:48 1169897748 Lisa 1516 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
27.01.2007 14:33:36 1169904816 Lisa 1516 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
27.01.2007 17:39:08 1169915948 Lisa 1516 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
27.01.2007 18:40:14 1169919614 Lisa 1516 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
27.01.2007 19:56:45 1169924205 Lisa 1516 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
28.01.2007 13:28:58 1169987338 Lisa 1104 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\smm32.exe\[MEW]" file.
07.02.2007 16:47:00 1170863220 SYSTEM 1064 Sign of "Win32:Warezov-MV [Wrm]" has been found in "C:\WINDOWS\system32\2.tmp.exe\[Upack]" file.
12.02.2007 18:13:00 1171300380 SYSTEM 1540 Sign of "Win32:Warezov-AJU [Wrm]" has been found in "C:\WINDOWS\accm.exe\[UPX]" file.
12.02.2007 20:17:35 1171307855 SYSTEM 1540 Sign of "Win32:Warezov-AJU [Wrm]" has been found in "C:\WINDOWS\accm.exe\[UPX]" file.
12.02.2007 21:26:19 1171311979 SYSTEM 1540 Sign of "Win32:Warezov-AJU [Wrm]" has been found in "C:\WINDOWS\accm.exe\[UPX]" file.
14.02.2007 16:00:19 1171465219 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: helen <helen.jeremy@guierfence.com>, An: daniel.fueger@baden-maniacs.de\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:00:20 1171465220 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: sandra lewis <sandra1975@vieng.com>, An: ewsletter@blume2000.de\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:00:20 1171465220 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'Mail server report.' Von: serv@elamex.com, An: ewsletter@blume2000.de\Update-KB5890-x86.exe#3116711390\[UPX]" file.
14.02.2007 16:10:48 1171465848 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'Mail server report.' Von: serv@fcradio.net, An: daniel.fueger@baden-maniacs.de\Update-KB8125-x86.exe#3116711390\[UPX]" file.
14.02.2007 16:10:50 1171465850 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: maria wright <maria.wright@niet.com>, An: maria@privat.de\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:11:00 1171465860 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: karen <martin_2004@selectplans.com>, An: site-policy@w3.org\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:11:01 1171465861 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: helen baker <helen.baker@selectplans.com>, An: sandra1975@vieng.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:11:02 1171465862 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'Mail server report.' Von: sec@phazen.net, An: maria@privat.de\Update-KB1437-x86.exe#3116711390\[UPX]" file.
14.02.2007 16:11:02 1171465862 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: joe <joe.hernandez@telcan.com>, An: cds1@bestweb.net\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:11:11 1171465871 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: brent <brent.hernandez@logoluso.com>, An: cds_400706@yahoo.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:12:24 1171465944 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: anna <anna.jackson@motorsportwarehouse.com>, An: mail@bagiramotors.ru\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:12:26 1171465946 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: Donna <Donna.harris@gametemple.com>, An: sales@glt.ru\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:12:31 1171465951 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: linda <linda.hernandez@niet.com>, An: cds218@geocities.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:12:31 1171465951 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: david wright <david.wright@vieng.com>, An: dean@ledmotion.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:22 1171466002 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: Donna walker <Donna.walker@firstclassmoving.com>, An: derrick@lightvision.com.tw\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: craig hernandez <craig.hernandez@iinet.net.au>, An: enquiries@sunseap.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: john <john1950@midmich.net>, An: detlef.eobaldt@lagoled.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: adam <adam.hall@vieng.com>, An: erose@ccrane.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: maria robyn <maria.robyn@firstclassmoving.com>, An: hans.hameeteman@adelco.nl\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: george <george.walker@motorsportwarehouse.com>, An: frankchen@mmm.com\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: helen <helen.clark@fcradio.net>, An: i0306@m06.r03.nalog.ru\postcard.zip#1599645333\postcard.exe\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'Mail server report.' Von: sec@midmich.net, An: u03@r03.nalog.ru\Update-KB3281-x86.exe#3116711390\[UPX]" file.
14.02.2007 16:13:45 1171466025 SYSTEM 1984 Sign of "Win32:Warezov-ASQ [Wrm]" has been found in "Ausgehende Mail 'postcard' Von: john green <john_ossjz@phazen.net>, An: i0308@r03.nalog.ru\postcard.zip#1599645333\postcard.exe\[UPX]" file.
20.02.2007 11:47:49 1171968469 Lisa 1564 Sign of "Win32:Warezov-AAU [Wrm]" has been found in "C:\WINDOWS\system32\diagisr.dll" file.
20.02.2007 11:48:02 1171968482 Lisa 1564 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\system32\isrprf32.dll" file.
20.02.2007 11:48:05 1171968485 Lisa 1564 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "C:\WINDOWS\system32\isrprov.exe" file.
09.03.2007 18:15:15 1173460515 SYSTEM 1548 Sign of "Win32:Warezov-BCY [Wrm]" has been found in "C:\WINDOWS\SYSTEM32\CONFWMV.DLL" file.
09.03.2007 18:15:29 1173460529 SYSTEM 1548 Sign of "Win32:Warezov-BCY [Wrm]" has been found in "C:\WINDOWS\SYSTEM32\WMVSTAT.DLL" file.
09.03.2007 18:17:24 1173460644 Lisa 2312 Sign of "Win32:Warezov-BCX [Wrm]" has been found in "c:\windows\system32\wmvmgr32.dll" file.
09.03.2007 19:55:31 1173466531 Lisa 1472 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\Programme\Morpheus\mymorpheusToolbar.exe" file.
09.03.2007 20:17:20 1173467840 Lisa 1472 Sign of "Win32:Warezov-BCY [Wrm]" has been found in "C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP36\A0017435.exe" file.
09.03.2007 20:17:20 1173467840 Lisa 1472 Sign of "Win32:Warezov-BCY [Wrm]" has been found in "C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP36\A0017436.dll" file.
12.03.2007 16:36:39 1173713799 Lisa 724 Sign of "Win32:Warezov-AAV [Wrm]" has been found in "C:\WINDOWS\system32\isrprf32.dll" file.
12.03.2007 16:36:47 1173713807 Lisa 724 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "C:\WINDOWS\system32\isrprov.exe" file.
12.03.2007 17:09:12 1173715752 Lisa 612 Sign of "Win32:Warezov-LH [Wrm]" has been found in "C:\Programme\ICQLite\ICQLite.exe" file.
12.03.2007 21:07:50 1173730070 Lisa 612 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "C:\WINDOWS\system32\isrprov.exe" file.
12.03.2007 21:23:17 1173730997 SYSTEM 796 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "C:\WINDOWS\system32\isrprov.exe" file.
13.03.2007 19:47:37 1173811657 SYSTEM 792 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "C:\WINDOWS\system32\isrprov.exe" file.
13.03.2007 19:57:47 1173812267 Lisa 4032 Function setifaceUpdatePackages() has failed. Return code is 0x000004C7, dwRes is 000004C7.
13.03.2007 20:11:51 1173813111 Lisa 3184 Sign of "Win32:Warezov-AAS [Wrm]" has been found in "c:\windows\system32\isrprov.exe" file.
Ich, und vor allam meine Tochter würden sich wirklich sehr freuen, wenn sich jemand diesem Problem annehmen würde. http://www.trojaner-board.de/images/smilies/bussi.gif

Jetzt schon mal vielen Dank

Hallo.

Der Rechner hat sich Würmer über Spam-Mails zugezogen. Nochmal der Hinweis: E-Mail Anhänge grundsätzlich nicht öffnen.

Lasse diese Datei bitte auf Virustotal checken und poste den Bericht mit allen Angaben:
" C:\WINDOWS\bin32.exe " dies stellt sicher, dass wir es nicht zusätzlich mit einem Trojaner zu tun haben..

Lade dir bitte dieses Tool auf den Rechner.
Deaktiviere die Systemwiederherstellung auf allen Laufwerken und lasse es arbeiten.

Danach erstelle bitte ein neues HJT log und wir sehen weiter.

(Habe mal aus dem Link-Versuch einen Link gemacht, schaut schöner aus Shadow)

Hi und vielen DAnk für die schnelle Antwort. Hier das aktuelle Logfile:
Logfile of HijackThis v1.99.1

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

danke
GUA
[/edit]

@Shadow:

(Habe mal aus dem Link-Versuch einen Link gemacht, schaut schöner aus Shadow)

ups, danke mir ist garnichts aufgefallen..

So weiter im Text: Das Tool war der Misserfolg überhaupt. Also auf die anstrengende Methode..

-Systemwiederherstellung deaktiviert lassen
-Die Anleitung zu MWAVE (eScan) aus meiner Signatur befolgen..
-Logfile posten.

Gruss

Undoreal

So, das hat jetzt ein wenig gedauert weil ich zwischendurchauch mal arbeiten muss. Anbei die eSacn-Datei:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Wed Mar 14 21:35:20 2007 => *** File C:\transfer\Linkin Park - Meteora\Linkin Park - Somewhere I belong (Album Version).mp3 having Size Restriction ***. Filesize 5016 kb
Wed Mar 14 21:23:38 2007 => Virus Database Date: 3/14/2007
Wed Mar 14 21:40:43 2007 => Virus Database Date: 3/14/2007
Wed Mar 14 17:20:14 2007 => Virus-Datenbank Datum: 3/14/2007
Wed Mar 14 18:15:11 2007 => Virus-Datenbank Datum: 3/14/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Mar 14 17:21:37 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: Keine Aktion vorgenommen.
Wed Mar 14 17:21:41 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Keine Aktion vorgenommen.
Wed Mar 14 21:24:26 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken.
Wed Mar 14 21:24:31 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Wed Mar 14 21:24:00 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:00 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:02 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:14 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:15 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:52 2007 => File C:\WINDOWS\spow32.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:57 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:04 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:09 2007 => File C:\WINDOWS\system32\idqdfrg.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:18 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:27:44 2007 => File C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Temp\29.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lt" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000187.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000197.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0002198.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:38:54 2007 => File C:\WINDOWS\spow32.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:38:59 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:17 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:20 2007 => File C:\WINDOWS\system32\idqdfrg.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:30 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:30 2007 => File C:\WINDOWS\system32\mprwanp.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:40:08 2007 => File C:\WINDOWS\Temp\4.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:40:43 2007 => File D:\AUTORUN.INF infected by "Fujack" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Wed Mar 14 17:21:41 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url
Wed Mar 14 21:24:31 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Wed Mar 14 17:21:39 2007 => Offending Key found: HKCU\\magnet !!!
Wed Mar 14 17:21:47 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!!
Wed Mar 14 21:24:28 2007 => Offending Key found: HKCU\\magnet !!!
Wed Mar 14 21:24:37 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Mar 14 18:15:11 2007 => Gefundene Viren: 24
Wed Mar 14 18:15:11 2007 => Anzahl Fehler: 58
Wed Mar 14 18:15:11 2007 => Dauer des Scans bisher: 00:54:04
Wed Mar 14 18:15:11 2007 => Gescannte Dateien: 72765
Wed Mar 14 17:21:06 2007 => Specherüberprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => Registry Überprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => System-Ordner Überprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Systembereiche: Deaktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Dienste: Aktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Festplatten: Deaktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung aller Festplatten :Aktiviert

Gut, wenn du diese Dateien noch brauchst, dann zippe sie bitte und belege sie mit einem Passwort:

"Wed Mar 14 17:21:41 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url"
"Wed Mar 14 21:24:31 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url"

Kennst du diese Datei? Lasse sie mal bitte auf Virustotal auswerten.
"D:\AUTORUN.INF" wenn sie wichtig ist bitte auch zippen und verschlüsseln.

Dann führe den eScan nochmal durch aber diesmal mit der Option "Scan and Clean"; Häkchen bei "Scan only" weglassen.

Poste danach bitte ein neues eScan log sowie ein HJT log. Beachte aber bitte den Hinweis von GUA.

mfg

Undoreal

Ich kann leider die Partition "D:" nicht öffnen. Die ist als von HP zur Wiederherstellung vorgesehen und irgendwie geschützt. Beim Versuch die Partition anzeigen zu lassen kommt immer nur ein Warhninweis.

Sorry, aber wer (oder was) ist GUA?!?

[edit]
bitte editiere zukünftig deine links, wie es dir u.a. hier angezeigt wird:
Aktive Links und persönliche Informationen in HJT Log-Files

danke
GUA
[/edit]

Ich kann leider die Partition "D:" nicht öffnen. Die ist als von HP zur Wiederherstellung vorgesehen und irgendwie geschützt. Beim Versuch die Partition anzeigen zu lassen kommt immer nur ein Warhninweis.

dann ist's egal..

Hi, hoffentlich hat das mit dem Editieren geklappt. Hab eigendlich nur in der HiJack-Datei ein http gefunden. Hier die beiden letzten Logs und mal wieder ein herzliches DAnkeschön auch für die Geduld.
Logfile of HijackThis v1.99.1
Scan saved at 16:07:43, on 15.03.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\notepad.exe
F:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=DE_DE&c=64&bd=pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\Programme\ICQToolbar\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] REM C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NvCplDaemon] REM RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] REM RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] REM CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] REM "C:\Programme\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] REM "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [QlbCtrl] REM %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Cpqset] REM C:\Programme\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\wlangui.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [wmvdiag] REM C:\WINDOWS\system32\wmvconf.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google-Suche - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Ins Deutsche übersetzen - res://C:\Programme\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Im Cache gespeicherte Seite - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Verweisseiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Ähnliche Seiten - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=h**p://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=64&bd=pavilion&pf=laptop
O20 - AppInit_DLLs: ccfgwshb.dll e1.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Programme\avmwlanstick\WlanNetService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programme\Sygate\SPF\smc.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows XP [Version 5.1.2600]
Thu Mar 15 15:15:21 2007 => *** File C:\transfer\Linkin Park - Meteora\Linkin Park - Somewhere I belong (Album Version).mp3 having Size Restriction ***. Filesize 5016 kb
Wed Mar 14 21:23:38 2007 => Virus Database Date: 3/14/2007
Wed Mar 14 21:40:43 2007 => Virus Database Date: 3/14/2007
Wed Mar 14 21:44:55 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 12:01:13 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 12:58:55 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 14:53:56 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 15:06:32 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 15:19:49 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 15:52:33 2007 => Virus Database Date: 3/14/2007
Thu Mar 15 15:54:42 2007 => Virus Database Date: 3/14/2007
Wed Mar 14 17:20:14 2007 => Virus-Datenbank Datum: 3/14/2007
Wed Mar 14 18:15:11 2007 => Virus-Datenbank Datum: 3/14/2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Mar 14 17:21:37 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: Keine Aktion vorgenommen.
Wed Mar 14 17:21:41 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: Keine Aktion vorgenommen.
Wed Mar 14 21:24:26 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken.
Wed Mar 14 21:24:31 2007 => System found infected with ezula Spyware/Adware (ebay.url)! Action taken: No Action Taken.
Thu Mar 15 12:06:03 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: Entries Removed.
Thu Mar 15 15:07:12 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken.
Thu Mar 15 15:53:55 2007 => System found infected with maxsearch Adware ({c4069e3a-68f1-403e-b40e-20066696354b})! Action taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Wed Mar 14 21:24:00 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:00 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:02 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:14 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:15 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:52 2007 => File C:\WINDOWS\spow32.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:24:57 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:04 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:09 2007 => File C:\WINDOWS\system32\idqdfrg.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:25:18 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:27:44 2007 => File C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Temp\29.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lt" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000187.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000197.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:35:15 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0002198.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:38:54 2007 => File C:\WINDOWS\spow32.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:38:59 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:17 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:20 2007 => File C:\WINDOWS\system32\idqdfrg.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:30 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:39:30 2007 => File C:\WINDOWS\system32\mprwanp.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:40:08 2007 => File C:\WINDOWS\Temp\4.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: No Action Taken.
Wed Mar 14 21:40:43 2007 => File D:\AUTORUN.INF infected by "Fujack" Virus! Action Taken: No Action Taken.
Thu Mar 15 12:04:51 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: File to be deleted on reboot.
Thu Mar 15 12:04:54 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: File to be deleted on reboot.
Thu Mar 15 12:04:57 2007 => File C:\WINDOWS\system32\mprwanp.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: File Deleted.
Thu Mar 15 12:05:06 2007 => File C:\WINDOWS\System32\idqdfrg.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: File Deleted.
Thu Mar 15 12:05:06 2007 => File C:\WINDOWS\System32\mprwanp.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 12:06:30 2007 => File C:\WINDOWS\spow32.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: File Deleted.
Thu Mar 15 12:07:15 2007 => File D:\AUTORUN.INF infected by "Fujack" Virus! Action Taken: Deleted.
Thu Mar 15 12:14:24 2007 => File C:\Dokumente und Einstellungen\Lisa\Lokale Einstellungen\Temp\29.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lt" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:26 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000187.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:27 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0000197.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:27 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0002198.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:27 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0004203.exe//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:28 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0004206.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:28 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0004207.dll infected by "Email-Worm.Win32.Warezov.la" Virus! Action Taken: File Deleted.
Thu Mar 15 12:48:28 2007 => File C:\System Volume Information\_restore{D1E51CDE-FC59-4EA3-8439-6656359D223D}\RP1\A0004208.exe infected by "Trojan-PSW.Win32.QQRob.fh" Virus! Action Taken: File Deleted.
Thu Mar 15 12:58:16 2007 => File C:\WINDOWS\Temp\4.tmp//PE_Patch//UPack infected by "Email-Worm.Win32.Warezov.lb" Virus! Action Taken: File Deleted.
Thu Mar 15 15:06:53 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:06:53 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:07:02 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:07:41 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:07:47 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:18:23 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:18:37 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:53:38 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:53:39 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:53:47 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:54:11 2007 => File C:\WINDOWS\system32\ccfgwshb.dll infected by "Email-Worm.Win32.Warezov.gen" Virus! Action Taken: No Action Taken.
Thu Mar 15 15:54:15 2007 => File C:\WINDOWS\system32\e1.dll infected by "Email-Worm.Win32.Warezov.dc" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Wed Mar 14 17:21:41 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url
Wed Mar 14 21:24:31 2007 => Offending file found: C:\Dokumente und Einstellungen\Administrator\Favoriten\ebay.url
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Wed Mar 14 17:21:39 2007 => Offending Key found: HKCU\\magnet !!!
Wed Mar 14 17:21:47 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!!
Wed Mar 14 21:24:28 2007 => Offending Key found: HKCU\\magnet !!!
Wed Mar 14 21:24:37 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!!
Thu Mar 15 12:06:06 2007 => Offending Key found: HKCU\\magnet !!!
Thu Mar 15 12:06:14 2007 => Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D !!!
Thu Mar 15 15:07:14 2007 => Offending Key found: HKCU\\magnet !!!
Thu Mar 15 15:53:57 2007 => Offending Key found: HKCU\\magnet !!!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Mar 14 18:15:11 2007 => Gefundene Viren: 24
Wed Mar 14 18:15:11 2007 => Anzahl Fehler: 58
Wed Mar 14 18:15:11 2007 => Dauer des Scans bisher: 00:54:04
Wed Mar 14 18:15:11 2007 => Gescannte Dateien: 72765
Wed Mar 14 17:21:06 2007 => Specherüberprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => Registry Überprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => System-Ordner Überprüfung: Aktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Systembereiche: Deaktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Dienste: Aktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung der Festplatten: Deaktiviert
Wed Mar 14 17:21:06 2007 => Überprüfung aller Festplatten :Aktiviert
Gruß, Peter

Zitat von PJM

Sorry, aber wer (oder was) ist GUA?!?

http://www.trojaner-board.de/members/gua.html
Zur Sache:

Wed Mar 14 18:15:11 2007 => Gefundene Viren: 24

Für mich ist nur eine Lösung denkbar: http://www.trojaner-board.de/12154-a...sicherung.html

Das hab ich mir fast schon gedacht. Frage: Wie schon erwähnt, hat das Notebook eine Restore-Partition. Kann ich den PC damit in den Verkaufszustand zurücksetzen, oder ist die PArtition eventuell auch infiziert.
Lohnt sich der Versuch?

Hallo,

also wenn schon neu installiert wird, würde ich das gleich richtig machen.
Alle Partitionen löschen, und dann neu formatieren, eine Recovery-CD nehme ich an liegt dir vor, oder?

Gruß
Oskar

Ja klar hab ich die. Vielen Dank noch mal an alle, die mir so selbstlos geholfen haben, vor allem natürlich undoreal. Werd mich dann mal morgen an ide Restaurierung machen.
Cu, PJM