| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Neben der Uhr steht: Virus AlertWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.09.2008, 20:21
| #1 |
| |  Neben der Uhr steht: Virus Alert Habe mir heute einen Virenscanner runterladen wollen und so einen sehr nervigen Virus eingefangen!!! Bitte um (für einen 0-8-15 PC-Nutzer verständliche) Hilfe... Leider habe ich den Virus gleich auf 2 PC`s. Hier das Logfile des einen rechners: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:10: VIRUS ALERT!, on 05.09.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe C:\Programme\CleanMyPC\Registry Cleaner\RCHelper.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\System32\alg.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Spyware Doctor\pctsAuxs.exe C:\Programme\Spyware Doctor\pctsSvc.exe C:\Programme\Spyware Doctor\pctsTray.exe C:\Programme\Spyware Doctor\pctsGui.exe C:\Dokumente und Einstellungen\Brennen\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.arcor.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.arcor.de R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - (no file) O3 - Toolbar: gksraemq - {6134A39A-C1EA-4E6F-B6D2-9ED5D9CC03B5} - C:\WINDOWS\gksraemq.dll O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Programme\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay O4 - HKLM\..\Run: [SpyHunter Security Suite] C:\Programme\Enigma Software Group\SpyHunter\SpyHunter3.exe O4 - HKLM\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe O4 - HKLM\..\Run: [\YUR6.exe] C:\Windows\system32\YUR6.exe O4 - HKLM\..\Run: [\YUR7.exe] C:\Windows\system32\YUR7.exe O4 - HKLM\..\Run: [\YUR8.exe] C:\Windows\system32\YUR8.exe O4 - HKLM\..\Run: [\YUR19.exe] C:\Windows\system32\YUR19.exe O4 - HKLM\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe O4 - HKLM\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe O4 - HKLM\..\Run: [\YURA.exe] C:\Windows\system32\YURA.exe O4 - HKLM\..\Run: [0810ed5b] rundll32.exe "C:\WINDOWS\system32\jrtxdtcd.dll",b O4 - HKLM\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe O4 - HKLM\..\Run: [\YUR17.exe] C:\Windows\system32\YUR17.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Google Update] "C:\Dokumente und Einstellungen\Brennen\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [AnyDVD] C:\Programme\SlySoft\AnyDVD\AnyDVDtray.exe O4 - HKCU\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe O4 - HKCU\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe O4 - HKCU\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe O4 - HKCU\..\Run: [\YURA.exe] C:\Windows\system32\YURA.exe O4 - HKCU\..\Run: [Registry Cleaner Scheduler] "C:\Programme\CleanMyPC\Registry Cleaner\RCHelper.exe" /startup O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe O4 - HKCU\..\Run: [\YUR17.exe] C:\Windows\system32\YUR17.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YURA.exe] C:\Windows\system32\YURA.exe (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [Registry Cleaner Scheduler] "C:\Programme\CleanMyPC\Registry Cleaner\RCHelper.exe" /startup (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe (User '?') O4 - HKUS\S-1-5-21-1417001333-813497703-854245398-1003\..\Run: [\YUR17.exe] C:\Windows\system32\YUR17.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Background Organizer PRO.lnk = C:\Programme\LOADSTREET\Background Organizer PRO\Desktop.exe O4 - Global Startup: Google Updater.lnk = C:\Programme\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programme\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: ecsbxk.dll O21 - SSODL: xrdwbfgn - {89C54EDC-C4F5-4748-ADDC-1DE0C350BFC1} - C:\WINDOWS\xrdwbfgn.dll O21 - SSODL: dgksvbpn - {C52AA2FC-0FD2-4B8F-B1FC-69B2206AA588} - (no file) O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe -- End of file - 7228 bytes Und dies stammt von meinem anderen rechner: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:37:05, on 05.09.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Wireless 11Mbps Network\XPFix.exe C:\Program Files\lg_fwupdate\fwupdate.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\dsfsd\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: {94dce973-f7c1-c1fa-bce4-12426dae49e5} - {5e94ead6-2421-4ecb-af1c-1c7f379ecd49} - C:\WINDOWS\system32\qfhooj.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: QXK Olive - {B5D0BE4E-83F4-4320-BC40-D96FA1620811} - C:\WINDOWS\vanwxemgner.dll O2 - BHO: (no name) - {E07D22E1-CE3A-487F-B754-8044DBEDB049} - C:\WINDOWS\system32\fcccYRIA.dll (file missing) O2 - BHO: (no name) - {E29BC4ED-E59F-496E-9C68-06ADD6CF6FB8} - C:\WINDOWS\system32\khfFWNgd.dll (file missing) O3 - Toolbar: gksraemq - {6134A39A-C1EA-4E6F-B6D2-9ED5D9CC03B5} - C:\WINDOWS\gksraemq.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [Alice] C:\Program Files\Wireless 11Mbps Network\XPFix.exe O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon O4 - HKCU\..\Run: [\YUR3.exe] C:\Windows\system32\YUR3.exe O4 - HKCU\..\Run: [\YUR4.exe] C:\Windows\system32\YUR4.exe O4 - HKCU\..\Run: [\YUR5.exe] C:\Windows\system32\YUR5.exe O4 - HKCU\..\Run: [\YUR6.exe] C:\Windows\system32\YUR6.exe O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\MSA\MSA.exe O4 - HKCU\..\Run: [\YUR1.exe] C:\Windows\system32\YUR1.exe O4 - HKCU\..\Run: [\YUR2.exe] C:\Windows\system32\YUR2.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user') O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: qfhooj.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll O20 - Winlogon Notify: fcccYRIA - fcccYRIA.dll (file missing) O21 - SSODL: dgksvbpn - {E947C9E0-6FC0-4481-BDFA-10AD096A87D5} - C:\WINDOWS\dgksvbpn.dll O21 - SSODL: xrdwbfgn - {D44C1E17-4940-4E6C-951A-FC2FF8A240F4} - C:\WINDOWS\xrdwbfgn.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm -- End of file - 6745 bytes Geändert von tscheebymoon (05.09.2008 um 20:38 Uhr) |
| Themen zu Neben der Uhr steht: Virus Alert |
| 41700, antivirus, avg security toolbar, avp, bho, ctfmon.exe, desktop, ebay, enigma, firefox, google update, hijack, hijackthis, hkus\s-1-5-18, home, homepage, internet explorer, kaspersky, logfile, mozilla, privacy protection, registry, registry cleaner, scan, security, security suite, software, spyware, system, virus, virus alert, virus alert!, virus eingefangen, windows, windows xp, wmid |
Baum-Darstellung