Hallo! habe ein sehr großes problem mit meinem pc. Eigentlch kann ich garnicht viel dazu sagen weil ich einfach nicht die große ahnung von vieren und Trojaner habe. vielleicht kann mir ja jemand helfen wenn ich die fehlermeldungen und die Hijack hier rein setzte. ich sag schonmal danke!

Logfile of Trend Micro HijackThis v2.0.2

[edit]
Bitte editiere zukünftig deine Links, wie es dir u.a. hier angezeigt wird:
http://www.trojaner-board.de/22771-a...tml#post171958

Danke.
Sunny
[/edit]



Fehlermeldungen von antivir:

In der Datei 'C:\WINDOWS\system32\diufypyi.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Agent.reo' [trojan] gefunden.

In der Datei 'C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\3PO8LB89\install_sbd_de[1].exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dldr.Age.1131784' [trojan] gefunden.

In der Datei 'C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\spihovvt.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.

n der Datei 'C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\Y3EA0ST3\kb516107[1]'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.

In der Datei 'C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\cotkeoyo.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden.

TR/dldr.age.1131784

ach falls das wichtig ist: ich habe das betriebssystem XP

Hallo und

Führe einen Scan mit dem Programm Malwarebytes durch und poste anschließend den Report hier.

hi!sorry erstmal das ich das nicht nach der Regel gemacht habe. aber ich bin einfach froh wenn das mal hinhaut hier zu schreiben ohne das der pc rummspinnt. naja habe nun den test gemacht, alles angezeigte löschen lassen und hier ist der Bericht :

Malwarebytes' Anti-Malware 1.17
Datenbank Version: 846

14:34:05 11.06.2008
mbam-log-6-11-2008 (14-34-05).txt

Scan Art: Komplett Scan (C:\|E:\|F:\|)
Objekte gescannt: 165505
Scan Dauer: 1 hour(s), 31 minute(s), 14 second(s)

Infizierte Speicher Prozesse: 1
Infizierte Speicher Module: 5
Infizierte Registrierungsschlüssel: 22
Infizierte Registrierungswerte: 4
Infizierte Datei Objekte der Registrierung: 2
Infizierte Verzeichnisse: 3
Infizierte Dateien: 31

Infizierte Speicher Prozesse:
C:\Programme\AntiSpywareExpert\ase_de.exe (Rogue.AntiSpywareExpert) -> Unloaded process successfully.

Infizierte Speicher Module:
C:\WINDOWS\system32\geBUOgHA.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\ynopwbym.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\wvUnNeee.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\Programme\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Unloaded module successfully.
C:\Programme\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> Unloaded module successfully.

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2a3f3c88-08c4-4daf-abe1-5c0fef8f3073} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{2a3f3c88-08c4-4daf-abe1-5c0fef8f3073} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e1bc0aab-2c35-40df-8f1d-4fd437df432e} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e1bc0aab-2c35-40df-8f1d-4fd437df432e} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvunneee (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\Software\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.AntiMalwareGuard) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e4516bfd (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e1bc0aab-2c35-40df-8f1d-4fd437df432e} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMe7625861 (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Datei Objekte der Registrierung:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebuogha -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\gebuogha -> Delete on reboot.

Infizierte Verzeichnisse:
C:\Programme\webHancer (Adware.Webhancer) -> Delete on reboot.
C:\Programme\webHancer\Programs (Adware.Webhancer) -> Delete on reboot.
C:\Programme\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\WINDOWS\system32\geBUOgHA.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\AHgOUBeg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AHgOUBeg.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ynopwbym.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\mybwpony.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wvUnNeee.dll (Trojan.Vundo) -> Delete on reboot.
C:\Programme\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Delete on reboot.
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\syswcc32.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\78QHTF1V\syswcc32[1].exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\BOJ3HC0B\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Programme\webHancer\whAgent_update.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP144\A0042257.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP144\A0042258.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP144\A0042259.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP145\A0042532.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP145\A0042767.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP147\A0042883.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP148\A0043947.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1C83F53C-8A8F-45AC-8FE7-6A6A4C775395}\RP148\A0044007.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\license.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\readme.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\sporder.dll (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\webhdll.dll (Adware.Webhancer) -> Delete on reboot.
C:\Programme\webHancer\Programs\whagent.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\whagent.ini (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
C:\Programme\AntiSpywareExpert\ase_de.exe (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Administrator\Desktop\AntiSpywareExpert.lnk (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\AntiSpywareExpert.lnk (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

hat keiner zeit mir zu helfen? brauche den pc demnächst für meine ausbildung... =/

Erstelle nun ein Logfile mit HijackThis und poste es hier.