| |
| |||||||
Log-Analyse und Auswertung: Bitte um Logfile AnalyseWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
30.03.2007, 12:46
| #1 |
| |  Bitte um Logfile Analyse Seite heute morgen spuckt Avira Antivirus immer die Fehlermeldung aus, das die winlogon.exe mit dem Trojaner: TR/WLHack.A infiziert ist. System Windows XP ------------ Logfile of HijackThis v1.99.1 Scan saved at 13:37:44, on 30.03.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AntiVir PersonalEdition Classic\sched.exe C:\Programme\AntiVir PersonalEdition Classic\avguard.exe C:\Programme\FRITZ!DSL\IGDCTRL.EXE C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\htpatch.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\D-Tools\daemon.exe C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe C:\Programme\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\ALCFDRTM.EXE C:\WINDOWS\Dit.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\Java\jre1.6.0\bin\jusched.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE C:\Programme\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\DitExp.exe C:\Programme\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe C:\Programme\ATI Technologies\ATI.ACE\CLI.exe C:\Programme\OpenOffice.org 2.0\program\soffice.exe C:\Programme\OpenOffice.org 2.0\program\soffice.BIN C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\MOZILL~2\THUNDE~1.EXE C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\Acrobat.exe C:\WINDOWS\System32\wisptis.exe C:\Dokumente und Einstellungen\***l\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ O1 - Hosts: 62.75.224.159 www.bns1.net O1 - Hosts: 62.75.224.159 www.bns2.net O1 - Hosts: 62.75.224.159 www.bns3.net O1 - Hosts: 62.75.224.159 www.bns4.net O1 - Hosts: 62.75.224.159 www.bns5.net O1 - Hosts: 62.75.224.159 www.bns6.net O1 - Hosts: 62.75.224.159 www.bns7.net O1 - Hosts: 62.75.224.159 www.bns8.net O1 - Hosts: 62.75.224.159 www.cms1.net O1 - Hosts: 62.75.224.159 www.cms2.net O1 - Hosts: 62.75.224.159 www.cms3.net O1 - Hosts: 62.75.224.159 www.cms4.net O1 - Hosts: 62.75.224.159 www.cms5.net O1 - Hosts: 62.75.224.159 www.cms6.net O1 - Hosts: 62.75.224.159 www.cms7.net O1 - Hosts: 62.75.224.159 www.cms8.net O1 - Hosts: 62.75.224.159 www.rg1.com O1 - Hosts: 62.75.224.159 www.rg2.com O1 - Hosts: 62.75.224.159 www.rg3.com O1 - Hosts: 62.75.224.159 www.rg4.com O1 - Hosts: 62.75.224.159 www.rg5.com O1 - Hosts: 62.75.224.159 www.rg6.com O1 - Hosts: 62.75.224.159 www.rg7.com O1 - Hosts: 62.75.224.159 www.rg8.com O1 - Hosts: 62.75.224.159 www.cjt1.net O1 - Hosts: 62.75.224.159 www.rgs1.net O1 - Hosts: 62.75.224.159 www.rgs2.net O1 - Hosts: 62.75.224.159 www.bns1.net O1 - Hosts: 62.75.224.159 www.bns2.net O1 - Hosts: 62.75.224.159 www.cms1.net O1 - Hosts: 62.75.224.159 www.cms2.net O1 - Hosts: 62.75.224.159 bns1.net O1 - Hosts: 62.75.224.159 bns2.net O1 - Hosts: 62.75.224.159 bns3.net O1 - Hosts: 62.75.224.159 bns4.net O1 - Hosts: 62.75.224.159 bns5.net O1 - Hosts: 62.75.224.159 bns6.net O1 - Hosts: 62.75.224.159 bns7.net O1 - Hosts: 62.75.224.159 bns8.net O1 - Hosts: 62.75.224.159 cms1.net O1 - Hosts: 62.75.224.159 cms2.net O1 - Hosts: 62.75.224.159 cms3.net O1 - Hosts: 62.75.224.159 cms4.net O1 - Hosts: 62.75.224.159 cms5.net O1 - Hosts: 62.75.224.159 cms6.net O1 - Hosts: 62.75.224.159 cms7.net O1 - Hosts: 62.75.224.159 cms8.net O1 - Hosts: 62.75.224.159 rg1.com O1 - Hosts: 62.75.224.159 rg2.com O1 - Hosts: 62.75.224.159 rg3.com O1 - Hosts: 62.75.224.159 rg4.com O1 - Hosts: 62.75.224.159 rg5.com O1 - Hosts: 62.75.224.159 rg6.com O1 - Hosts: 62.75.224.159 rg7.com O1 - Hosts: 62.75.224.159 rg8.com O1 - Hosts: 62.75.224.159 cjt1.net O1 - Hosts: 62.75.224.159 rgs1.net O1 - Hosts: 62.75.224.159 rgs2.net O1 - Hosts: 62.75.224.159 bns1.net O1 - Hosts: 62.75.224.159 bns2.net O1 - Hosts: 62.75.224.159 cms1.net O1 - Hosts: 62.75.224.159 cms2.net O1 - Hosts: 62.75.224.159 j800banners.cjt1.net O1 - Hosts: 62.75.224.159 jadlogix.cjt1.net O1 - Hosts: 62.75.224.159 jadtegrity.cjt1.net O1 - Hosts: 62.75.224.159 jaimmedia.cjt1.net O1 - Hosts: 62.75.224.159 javatar.cjt1.net O1 - Hosts: 62.75.224.159 jbeet.cjt1.net O1 - Hosts: 62.75.224.159 jbigpops.cjt1.net O1 - Hosts: 62.75.224.159 jbouncetek.cjt1.net O1 - Hosts: 62.75.224.159 jbravenet.cjt1.net O1 - Hosts: 62.75.224.159 jcdcover.cjt1.net O1 - Hosts: 62.75.224.159 jclickspring.cjt1.net O1 - Hosts: 62.75.224.159 jcollegehumor.cjt1.net O1 - Hosts: 62.75.224.159 jdownloadacc.cjt1.net O1 - Hosts: 62.75.224.159 jedonkey.cjt1.net O1 - Hosts: 62.75.224.159 jeuniverse.cjt1.net O1 - Hosts: 62.75.224.159 jhot.cjt1.net O1 - Hosts: 62.75.224.159 jicmedia.cjt1.net O1 - Hosts: 62.75.224.159 jicq.cjt1.net O1 - Hosts: 62.75.224.159 jieplugin.cjt1.net O1 - Hosts: 62.75.224.159 jinternetoptimizer.cjt1.net O1 - Hosts: 62.75.224.159 jmediabuy1.cjt1.net O1 - Hosts: 62.75.224.159 jmediabuyad.cjt1.net O1 - Hosts: 62.75.224.159 jmindset.cjt1.net O1 - Hosts: 62.75.224.159 jmindsettest.cjt1.net O1 - Hosts: 62.75.224.159 jnictech.cjt1.net O1 - Hosts: 62.75.224.159 jnova.cjt1.net O1 - Hosts: 62.75.224.159 jpiolet.cjt1.net O1 - Hosts: 62.75.224.159 jsanboxer.cjt1.net O1 - Hosts: 62.75.224.159 jsercee.cjt1.net O1 - Hosts: 62.75.224.159 jthedelfin.cjt1.net O1 - Hosts: 62.75.224.159 jwarezp2p.cjt1.net O1 - Hosts: 62.75.224.159 jwildmedia.cjt1.net O1 - Hosts: 62.75.224.159 mediabuy-nic.cjt1.net O1 - Hosts: 62.75.224.159 www.m7z.net O1 - Hosts: 62.75.224.159 m7z.net O1 - Hosts: 62.75.224.159 jcms.cydoor.com O1 - Hosts: 62.75.224.159 cydoor.com O1 - Hosts: 62.75.224.159 www.cydoor.com O1 - Hosts: 62.75.224.159 jnova.cjt1.net O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [syspath791] C:\WINDOWS\System32\driver.exe O4 - HKLM\..\Run: [FastTVSync] "C:\Program Files\Common Files\InterVideo\FastTVSync\FastTVSync.exe" O4 - HKLM\..\Run: [AdobeVersionCue] C:\Programme\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [AlcFDMonitor] C:\WINDOWS\ALCFDRTM.EXE O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [MsConfigs] C:\Programme\MsConfigs\MsConfigs.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0\bin\jusched.exe" O4 - HKLM\..\Run: [\\VORSTUFE2\EPSON Stylus D78 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBGE.EXE /FU "C:\DOKUME~1\****\LOKALE~1\Temp\E_S47.tmp" /EF "HKLM" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [AOLMIcon] C:\Programme\Gemeinsame Dateien\aolshare\AOLMIcon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: OpenOffice.org 2.0.lnk = C:\Programme\OpenOffice.org 2.0\program\quickstart.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0\bin\ssv.dll O9 - Extra button: MedionShop - {CCB1B892-287D-49A8-9F7F-C012D65F85E9} - ***/ (file missing) (HKCU) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/176ee4b6f3ebd9218f21/netzip/RdxIE601_de.cab O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.140/code/PWActiveXImgCtl.CAB O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp03.photoprintit.de/microsite/defaults/activex/ImageUploader3.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{6CFCC96A-579F-4980-A95F-2634CD95AFFF}: NameServer = 162.0.10.254 O17 - HKLM\System\CCS\Services\Tcpip\..\{EFF1532A-A54D-4F89-AC6B-39D70A17D01D}: NameServer = 162.0.10.254 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Programme\Adobe\Adobe Version Cue\service\VersionCue.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\Programme\FRITZ!DSL\IGDCTRL.EXE O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\Program Files\Common Files\AVM\de_serv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe |
|
30.03.2007, 12:49
| #2 |
| Administrator > Competence Manager  | Bitte um Logfile Analyse__________________
__________________ |
|
30.03.2007, 12:53
| #3 |
| | Bitte um Logfile Analyse Sorry, habe ich ne Minute nach dem Einstellen auch gefunden
__________________ Trotzdem Danke!!!!  |
|
| Themen zu Bitte um Logfile Analyse |
| adobe, antivirus, avgnt, avgnt.exe, avira, bho, desktop, dll, drivers, dsl, einstellungen, explorer, fehlermeldung, firefox, hijack, hijackthis, infiziert, internet, internet explorer, logfile, logon.exe, mozilla, mozilla firefox, rundll, software, system, temp, trojaner, windows, winlogon.exe |
Linear-Darstellung
