| |
| |||||||
Log-Analyse und Auswertung: 96676 ich kriege es einfach nicht hinWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.06.2004, 15:59
| #1 |
| |  96676 ich kriege es einfach nicht hin Hallo zusammen, ich brauche Hilfe beim Remove von dem Trojaner 96676. Ich kriege den einfach nicht weg. Was muss ich alles entfernen ? Hier mein logfile: Logfile of HijackThis v1.97.7 Scan saved at 10:18:44, on 2004-06-29 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\winmg.exe C:\WINDOWS\Explorer.EXE C:\Program\Real\RealPlayer\RealPlay.exe C:\WINDOWS\SYSTEM32\qttask.exe C:\Program\Support.com\bin\tgcmd.exe C:\WINDOWS\appem32.exe C:\WINDOWS\System32\rdqkse.exe C:\Program\Java\j2re1.4.2_01\bin\jusched.exe C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\Documents and Settings\HP-Auktoriserad kund\Application Data\wrda.exe C:\WINDOWS\System32\NDrv.exe C:\Program\Handelsbanken\Säkerhetslösning\ssrlite.exe C:\Program\iD2\CSP\iD2CertMover.exe C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe C:\Program\Nokia\PCSUIT~1\BROADC~1.EXE C:\WINDOWS\System32\svchost.exe C:\Frank\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.iquicksearch.net/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer,Default_Search_URL = http://www.searchnow.ws/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://wmkro.dll/index.html#96676 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://wmkro.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://wmkro.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenordia Internet Explorer R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = res://wmkro.dll/index.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file) O2 - BHO: (no name) - {EBC21DD1-18C4-74D7-C935-89E653731491} - C:\WINDOWS\ipnz32.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime O4 - HKLM\..\Run: [TeliaTGCMD] "C:\Program\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf O4 - HKLM\..\Run: [appem32.exe] C:\WINDOWS\appem32.exe O4 - HKLM\..\Run: [hocvtxlsws] C:\WINDOWS\System32\rdqkse.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKCU\..\Run: [MoneyAgent] "C:\Program\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [LDM] C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [Rews] C:\Documents and Settings\HP-Auktoriserad kund\Application Data\wrda.exe O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe O4 - HKLM\..\RunOnce: [winmg.exe] C:\WINDOWS\winmg.exe O4 - Global Startup: Handelsbankens säkerhetsprogram.lnk = ? O4 - Global Startup: iD2 CSP Certificate Utility.lnk = C:\Program\iD2\CSP\iD2CertMover.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Encoder Agent.lnk = C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Anslutning för PC Suite for Nokia 9210i Communicator.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe O4 - Global Startup: PC Suite for Nokia 9210i Communicator Task Scheduler.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java-konsol (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .avi: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpe: C:\Program\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .sgn: C:\PROGRAM\INTERN~1\PLUGINS\npSign.dll O12 - Plugin for .wav: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O13 - DefaultPrefix: O13 - WWW Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {037B3D58-D14A-4C41-BDFD-BD779B0B97BA} (vxiewer control) - http://www.thepaymentcentre.com/build/vxiewer.cab O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productu...ntent/opuc.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT\AcDcToday.ocx O16 - DPF: {869F3BBC-A812-4D13-A93B-7B3FC816DCD5} (McAfee.com Updater) - http://download.mcafee.com/molbin/cl...an/mcasupd.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...130.4869097222 O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT\InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD LT\InstFred.ocx O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DF261D07-7E99-11D4-B2C7-009027A1F18A} (DDI Print Control Class v1.2 [ENU]) - https://eredovisning.postgirot.se/dd...k/iedpwenu.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{B2174E1E-134A-4CAD-8992-126C71B6B808}: NameServer = 195.67.199.18,195.67.199.19 |
|
29.06.2004, 16:52
| #2 |
 |  96676 ich kriege es einfach nicht hin hi frankdittrich,
__________________folgende prozesse soltest du hier prüfen lassen: winmg.exe appem32.exe rdqkse.exe NDrv.exe (Ergebnis mal jeweils posten interessiert mich) anschließend folgendes: 1.escan runterladen: http://www.mwti.net/antivirus/free_utilities.asp (Datei dann entpacken in einen von dir erstellten ordner namens c:\bases) 2. escan updaten (kavupd.exe in dem Verzeichnis c:\bases ausführen) 3. Windows im abgesicherten modus neu starten http://www.bsi.de/av/texte/winsave.htm#WindowsXP 4. Das Programm aus 1. ausführen (kvss.exe) Dabei die Einstellungen vornehmen wie hier beschrieben dann Rechner neu starten und neues Log File posten (vor dem ergebnis über die o.g. prozesse sag ich noch mal nichts zum fixen der Einträge unter HJT) |
|
30.06.2004, 16:15
| #3 |
| | 96676 ich kriege es einfach nicht hin Hallo Radja,
__________________erstmal schönen Dank das Du mir hilfst !!! Hier die Log's vom Scan via Kaspersky: Zu überprüfende Datei: winmg.exe winmg.exe - packed with UPX winmg.exe Infiziert: TrojanDownloader.Win32.Agent.an Statistiken: Bekannte Viren: 92069 Updated: 29-06-2004 Größe der Datei (Kb): 9 Viren-Korpus: 1 Datei: 2 Warnungen: 0 Archive: 0 Verdächtigt: 0 Zu überprüfende Datei: appem32.exe appem32.exe - packed with UPX appem32.exe Infiziert: TrojanDownloader.Win32.Agent.an Statistiken: Bekannte Viren: 92069 Updated: 29-06-2004 Größe der Datei (Kb): 28 Viren-Korpus: 1 Datei: 2 Warnungen: 0 Archive: 0 Verdächtigt: 0 Zu überprüfende Datei: NDrv.exe NDrv.exe Ok Statistiken: Bekannte Viren: 92069 Updated: 29-06-2004 Größe der Datei (Kb): 328 Viren-Korpus: 0 Datei: 1 Warnungen: 0 Archive: 0 Verdächtigt: 0 Bei rdqkse.exe sagt der Scanner gar nichts ! Dann habe ich das gemacht was Du gesagt hast. Hier der Log von e-scan: File C:\WINDOWS\appem32.exe infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\WINDOWS\System32\rdqkse.exe infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted. File C:\WINDOWS\winmg.exe infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\DOCUME~1\HP-AUK~1\APPLIC~1\wrda.exe infected by "TrojanDownloader.Win32.PurityScan.b" Virus. Action Taken: File Deleted. File C:\WINDOWS\TEMP\cd_clint.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. File C:\WINDOWS\TEMP\cd_Install_2022.exe tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. File C:\WINDOWS\vdanzb.dat infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\WINDOWS\xgskmi.dat infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\WINDOWS\ipnz32.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\WINDOWS\msxmidi.exe infected by "TrojanDownloader.Win32.Agent.z" Virus. Action Taken: File Deleted. File C:\WINDOWS\e.exe infected by "TrojanDownloader.Win32.Small.lc" Virus. Action Taken: File Deleted. File C:\WINDOWS\dpe.dll infected by "TrojanDownloader.Win32.Small.ai" Virus. Action Taken: File Deleted. File C:\WINDOWS\wmkro.dll infected by "TrojanDownloader.Win32.Winshow.u" Virus. Action Taken: File Deleted. File C:\WINDOWS\Downloaded Program Files\movies2.exe infected by "Trojan.Win32.StartPage.z" Virus. Action Taken: File Deleted. File C:\WINDOWS\Downloaded Program Files\MediaTicketsInstaller.ocx tagged as not-a-virus:AdvWare.MediaTickets.b. No Action Taken. File C:\WINDOWS\Downloaded Program Files\ISTactivex.dll infected by "TrojanDownloader.Win32.IstBar.fa" Virus. Action Taken: File Deleted. File C:\WINDOWS\newdotnet3_36.dll tagged as not-a-virus:AdvWare.NewDotNet. No Action Taken. File C:\HP\bin\Terminator.exe tagged as not-a-virus:RiskWare.Tool.KillApp. No Action Taken. File C:\Program\AVPersonal\INFECTED\879F6FC0.0CD infected by "I-Worm.Tanatos.b" Virus. Action Taken: File Deleted. File C:\Program\AVPersonal\INFECTED\QXYP.VIR infected by "I-Worm.Tanatos.b" Virus. Action Taken: File Deleted. File C:\Program\AVPersonal\INFECTED\wintcc.VIR infected by "Trojan.Win32.Scapur" Virus. Action Taken: File Deleted. File C:\HP Internet\MP3\napv2b8.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\install.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\kmd171gu_en.exe tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer1.zip infected by "Password-protected-EXE" Virus. Action Taken: File Renamed. File C:\Documents and Settings\All Users\Skrivbord\Daniel\AGSetup0606.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\THI2DAA.tmp\preInsTT.exe tagged as not-a-virus:AdvWare.BiSpy.f. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\THI2DAA.tmp\polall1t.exe infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\powerscan.exe tagged as not-a-virus:AdvWare.PowerScan.b. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\iinstall.exe infected by "TrojanDownloader.Win32.IstBar.gen" Virus. Action Taken: File Deleted. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\wu.exe tagged as not-a-virus:AdvWare.SaveNow.z. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\THI539B.tmp\preInsTT.exe tagged as not-a-virus:AdvWare.BiSpy.f. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\THI539B.tmp\polall1t.exe infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\~70.exe tagged as not-a-virus:PornWare.Dialer.Generic. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\~6E.exe tagged as not-a-virus:PornWare.Dialer.Generic. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Lokala inställningar\Temp\~72.exe tagged as not-a-virus:PornWare.Dialer.Generic. No Action Taken. File C:\Documents and Settings\HP-Auktoriserad kund\Mina dokument\Ingela\install RSV.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP283\A0028963.exe tagged as not-a-virus:AdvWare.SaveNow.s. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP283\A0028964.dll tagged as not-a-virus:AdvWare.SaveNow.s. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP276\A0028193.exe tagged as not-a-virus:AdvWare.SaveNow.v. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP276\A0028196.exe tagged as not-a-virus:AdvWare.SaveNow.m. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028301.dll infected by "TrojanDownloader.Win32.Small.me" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028302.dll infected by "TrojanDownloader.Win32.Small.me" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028303.exe infected by "Trojan.Win32.Dialer.by" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028304.exe infected by "Trojan.Win32.Dialer.by" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028305.exe infected by "Trojan.Win32.Dialer.by" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028306.exe infected by "Trojan.Win32.Dialer.by" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028308.exe infected by "TrojanDownloader.Win32.Agent.z" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028309.exe tagged as not-a-virus:PornWare.Dialer.Holistyc.gen. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP281\A0028310.exe infected by "TrojanDownloader.Win32.Agent.z" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029041.exe tagged as not-a-virus:AdvWare.PurityScan.k. No Action Taken. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029047.exe infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029048.exe infected by "TrojanDownloader.Win32.Agent.ae" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029049.exe infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029050.exe infected by "TrojanDownloader.Win32.PurityScan.b" Virus. Action Taken: File Deleted. 'File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029051.dll infected by "TrojanDownloader.Win32.Agent.an" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029052.exe infected by "TrojanDownloader.Win32.Agent.z" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029053.exe infected by "TrojanDownloader.Win32.Small.lc" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029054.dll infected by "TrojanDownloader.Win32.Small.ai" Virus. Action Taken: File Deleted. File C:\System Volume Information\_restore{93EDF9E7-06CD-4CD8-B8E0-538B20D28A6B}\RP288\A0029055.dll infected by "TrojanDownloader.Win32.Winshow.u" Virus. Action Taken: File Deleted. ZWEITE ANTOWRT FOLGT SOFORT, DA MAN NUR 10000 ZEICHEN EINGEBEN DARF. |
|
30.06.2004, 16:15
| #4 |
| | 96676 ich kriege es einfach nicht hin EMAIL 2 Danach habe ich noch einen HijackThis scan gemacht. Logfile of HijackThis v1.97.7 Scan saved at 17:09:28, on 2004-06-30 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\Explorer.EXE C:\Program\Real\RealPlayer\RealPlay.exe C:\WINDOWS\SYSTEM32\qttask.exe C:\Program\Support.com\bin\tgcmd.exe C:\Program\Java\j2re1.4.2_01\bin\jusched.exe C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\WINDOWS\System32\NDrv.exe C:\Program\Handelsbanken\Säkerhetslösning\ssrlite.exe C:\Program\iD2\CSP\iD2CertMover.exe C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe C:\Program\Nokia\PCSUIT~1\BROADC~1.EXE C:\Frank\HijackThis.exe C:\WINDOWS\System32\svchost.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.iquicksearch.net/search.htm R1 - HKCU\Software\Microsoft\Internet Explorer,Default_Search_URL = http://www.searchnow.ws/search/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://wmkro.dll/index.html#96676 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://wmkro.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://wmkro.dll/index.html#96676 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\wmkro.dll/sp.html#96676 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenordia Internet Explorer R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://homepage.com%00@www.e-finder.cc/search/ (obfuscated) O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file) O2 - BHO: (no name) - {EBC21DD1-18C4-74D7-C935-89E653731491} - C:\WINDOWS\ipnz32.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime O4 - HKLM\..\Run: [TeliaTGCMD] "C:\Program\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [mwavscan] "C:\bases\mwavscan.com" /s O4 - HKCU\..\Run: [MoneyAgent] "C:\Program\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [LDM] C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe O4 - Global Startup: Handelsbankens säkerhetsprogram.lnk = ? O4 - Global Startup: iD2 CSP Certificate Utility.lnk = C:\Program\iD2\CSP\iD2CertMover.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Encoder Agent.lnk = C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Anslutning för PC Suite for Nokia 9210i Communicator.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe O4 - Global Startup: PC Suite for Nokia 9210i Communicator Task Scheduler.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java-konsol (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .avi: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpe: C:\Program\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .sgn: C:\PROGRAM\INTERN~1\PLUGINS\npSign.dll O12 - Plugin for .wav: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O13 - DefaultPrefix: O13 - WWW Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {037B3D58-D14A-4C41-BDFD-BD779B0B97BA} (vxiewer control) - http://www.thepaymentcentre.com/build/vxiewer.cab O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...06_regular.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productu...ntent/opuc.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT\AcDcToday.ocx O16 - DPF: {869F3BBC-A812-4D13-A93B-7B3FC816DCD5} (McAfee.com Updater) - http://download.mcafee.com/molbin/cl...an/mcasupd.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...130.4869097222 O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT\InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD LT\InstFred.ocx O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DF261D07-7E99-11D4-B2C7-009027A1F18A} (DDI Print Control Class v1.2 [ENU]) - https://eredovisning.postgirot.se/dd...k/iedpwenu.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{B2174E1E-134A-4CAD-8992-126C71B6B808}: NameServer = 195.67.199.18,195.67.199.19 Was soll ich jetzt machen ? Nochmal vielen Dank für Deine Hilfe. mfg Frank |
|
30.06.2004, 17:22
| #5 |
| | 96676 ich kriege es einfach nicht hin folgende Einträge solltest du mittels HJT fixen: sämtliche R1 und R0 Einträge O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file) O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softw...006_regular.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{B2174E1E-134A-4CAD-8992-126C71B6B808}: NameServer = 195.67.199.18,195.67.199.19 danach mal berichten und neues log posten! |
|
01.07.2004, 09:53
| #6 |
| | 96676 ich kriege es einfach nicht hin Hallo Radja, ich glaube es hat jetzt geklappt.  Habe den Rechner mehrmals neu gestartet und 96676 ist nicht mehr aufgetaucht. Hier kommt der Logfile, den Du noch haben wolltest. Sieht eigentlich ganz gut aus, oder ? Logfile of HijackThis v1.97.7 Scan saved at 10:47:59, on 2004-07-01 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\Explorer.EXE C:\Program\Real\RealPlayer\RealPlay.exe C:\WINDOWS\SYSTEM32\qttask.exe C:\Program\Support.com\bin\tgcmd.exe C:\Program\Java\j2re1.4.2_01\bin\jusched.exe C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe C:\WINDOWS\System32\NDrv.exe C:\Program\Handelsbanken\Säkerhetslösning\ssrlite.exe C:\Program\iD2\CSP\iD2CertMover.exe C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe C:\Program\Nokia\PCSUIT~1\BROADC~1.EXE C:\WINDOWS\System32\svchost.exe C:\Frank\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: (no name) - {EBC21DD1-18C4-74D7-C935-89E653731491} - C:\WINDOWS\ipnz32.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [RealTray] C:\Program\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime O4 - HKLM\..\Run: [TeliaTGCMD] "C:\Program\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\j2re1.4.2_01\bin\jusched.exe O4 - HKLM\..\Run: [mwavscan] "C:\bases\mwavscan.com" /s O4 - HKCU\..\Run: [MoneyAgent] "C:\Program\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [LDM] C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [NDrv] C:\WINDOWS\System32\NDrv.exe O4 - Global Startup: Handelsbankens säkerhetsprogram.lnk = ? O4 - Global Startup: iD2 CSP Certificate Utility.lnk = C:\Program\iD2\CSP\iD2CertMover.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Encoder Agent.lnk = C:\Program\Windows Media Components\Encoder\WMENCAGT.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Anslutning för PC Suite for Nokia 9210i Communicator.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ConnectState.exe O4 - Global Startup: PC Suite for Nokia 9210i Communicator Task Scheduler.lnk = C:\Program\Nokia\PC Suite for Nokia 9210i Communicator\ECTaskScheduler.exe O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java-konsol (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .avi: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O12 - Plugin for .mpe: C:\Program\Internet Explorer\PLUGINS\npqtplugin3.dll O12 - Plugin for .sgn: C:\PROGRAM\INTERN~1\PLUGINS\npSign.dll O12 - Plugin for .wav: C:\Program\Internet Explorer\PLUGINS\npqtplugin.dll O13 - DefaultPrefix: O13 - WWW Prefix: O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {037B3D58-D14A-4C41-BDFD-BD779B0B97BA} (vxiewer control) - http://www.thepaymentcentre.com/build/vxiewer.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productu...ntent/opuc.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD LT\AcDcToday.ocx O16 - DPF: {869F3BBC-A812-4D13-A93B-7B3FC816DCD5} (McAfee.com Updater) - http://download.mcafee.com/molbin/cl...an/mcasupd.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...130.4869097222 O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD LT\InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD LT\InstFred.ocx O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {DF261D07-7E99-11D4-B2C7-009027A1F18A} (DDI Print Control Class v1.2 [ENU]) - https://eredovisning.postgirot.se/dd...k/iedpwenu.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT\AcPreview.ocx Vielen Dank nochmal für Deine Hilfe ! mfh aus Schweden Frank |
|
01.07.2004, 10:30
| #7 |
| | 96676 ich kriege es einfach nicht hin Hallo frankdittrich, kann dem Log jetzt auch nichts problematisches mehr entnehmen. Freut mich, dass es geklappt hat und ich Dir helfen konnte! Grüsse Radja |
|
01.07.2004, 10:39
| #8 | |||
  |  96676 ich kriege es einfach nicht hinZitat:
 Zitat:
Diese Einträge kann ich nicht einordnen: Zitat:
__________________ Gruß, Lutz *** "Nur weil ich paranoid bin, bedeutet das nicht, dass sie nicht hinter mir her sind!" (Matthias Deutschmann) |
|
01.07.2004, 10:47
| #9 |
| | 96676 ich kriege es einfach nicht hin @ lutz inwiefern ist denn der O2 Eintrag problematisch?? (Mer will ja immer noch was dazu lernen) |
|
01.07.2004, 11:35
| #10 | |
| | 96676 ich kriege es einfach nicht hinZitat:
__________________ Gruß, Lutz *** "Nur weil ich paranoid bin, bedeutet das nicht, dass sie nicht hinter mir her sind!" (Matthias Deutschmann) |
|
01.07.2004, 11:37
| #11 |
| | 96676 ich kriege es einfach nicht hin ok Danke! Radja |
|
| Themen zu 96676 ich kriege es einfach nicht hin |
| .com, application, bho, brauche hilfe, button, components, desktop, entfernen, excel, explorer, hijack, hijackthis, hilfe, internet, internet explorer, logfile, messenger, microsoft, monitor, obfuscated, object, realplayer, shockwave, software, start, system, system32, tcpip, trojaner, windows, windows messenger, windows xp |
Linear-Darstellung
