Hi All

Ich brauche eure Hilfe.
Ich hab folgendes Probleme:
Mein PC ist allgemein langsamer geworden und Downloaden besonders.
Ich habe ein eScan durchgeführt, das Ergebnis:

File C:\WINDOWS\GamezAG[gmz-10007,de,lay9].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\Hacker[hcd-11476,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\p2p[p2p-10074,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\p2p[p2p-10819,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\Supergames[srs-10001,de,1].exe tagged as not-a-virus:PornWare.Dialer.Star. No Action Taken.
File C:\Dokumente und Einstellungen\Marco\Desktop\Downloads\Swish v2.01\SetupSwish200_Crypkey.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Downloaded Program Files\dMi_192.exe infected by "Trojan.Win32.Dialer.cj" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\GamezAG[gmz-10007,de,lay9].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\Hacker[hcd-11476,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\p2p[p2p-10074,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\p2p[p2p-10819,de].exe tagged as not-a-virus:PornWare.Dialer.Intexdial. No Action Taken.
File C:\WINDOWS\Supergames[srs-10001,de,1].exe tagged as not-a-virus:PornWare.Dialer.Star. No Action Taken.
File E:\Swish v2.01.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

______________________________________________________________
______________________________________________________________

[[[[[ Mit HijackThis auch ein Logfile erstellt ]]]]]
-----------------------------------------------------------------------
Logfile of HijackThis v1.98.2
Scan saved at 12:06:39, on 04.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://geocities.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://geocities.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.geocities.com
R3 - URLSearchHook: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
R3 - URLSearchHook: (no name) - {E5A2678F-DA83-4D2E-BA85-6236E90098FA} - (no file)
O1 - Hosts: 66.159.20.51 astalavista.box.sk
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 6\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 6\SnagItIEAddin.dll
O3 - Toolbar: win32 - {C94158E1-6151-4442-ABE6-FD53D6534EFB} - C:\WINDOWS\Downloaded Program Files\win32.dll (file missing)
O3 - Toolbar: (no name) - {E5A2678F-DA83-4D2E-BA85-6236E90098FA} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://c:\info6.cab
O16 - DPF: {11111111-1111-1111-1111-111111111237} - http://66.117.37.5/1/deaDE365.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab28177.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/017453c2...p/RdxIE601.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://god.t-online.de/download/ExentCtl.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28177.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {C94158E1-6151-4442-ABE6-FD53D6534EFB} (win32) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.comp...io5_3_18_0.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary...reShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8DBED9AA-63CF-44E3-B03A-00BDCA9F26BE}: NameServer = 217.237.149.161 217.237.151.225
________________________________________________________

Und ich habe folgende Prozesse laufen:

PROFIL~1.EXE > User
sc_watch.exe > User
kernel.exe > User
msmsgs.exe > User
taskmgr.exe > User
svchost.exe > SYSTEM
ctfmon.exe > User
nvsvc32.exe > SYSTEM
ccApp.exe > User
E_S10IC2.EXE > User
rundll32.exe > User
realshed.exe > User
ToADiMon.exe > User
explorer.exe > User
NPROTECT.EXE > SYSTEM
SAgent2.exe > SYSTEM
Crypserv.exe > SYSTEM
NISUM.EXE > SYSTEM
ccEvtMgr.exe > SYSTEM
spoolsv.exe > SYSTEM
CCPXYSVC.EXE > SYSTEM
alg.exe > LOKALER DIENST
svchost.exe > LOKALER DIENST
svchost.exe > NETZWERKDIENST
svchost.exe > SYSTEM
svchost.exe > SYSTEM
Navpasvc.exe > SYSTEM
lsass.exe > SYSTEM
services.exe > SYSTEM
winlogon.exe > SYSTEM
csrss.exe > SYSTEM
smss.exe > SYSTEM
browser.exe > User
System > SYSTEM
Leerlaufprozess > SYSTEM

..................................................................................



Ich hoffe ihr könnt mir helfen.

Schöne Gruß. ML

Gehst du über DSL ins Netz oder über Modem/ISDN? Falls DSL: lösche die von E-Scan als Dialer angegebenen Dateien, falls Modem, sichere sie vorher auf Diskette.

Fixe mit Hijackthis:


R3 - URLSearchHook: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
R3 - URLSearchHook: (no name) - {E5A2678F-DA83-4D2E-BA85-6236E90098FA} - (no file)
O1 - Hosts: 66.159.20.51 astalavista.box.sk
O3 - Toolbar: win32 - {C94158E1-6151-4442-ABE6-FD53D6534EFB} - C:\WINDOWS\Downloaded Program Files\win32.dll (file missing)
O3 - Toolbar: (no name) - {E5A2678F-DA83-4D2E-BA85-6236E90098FA} - (no file)
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - (no file)
O16 - DPF: {11111111-1111-1111-1111-111111111111} - file://c:\info6.cab
O16 - DPF: {11111111-1111-1111-1111-111111111237} - http://66.117.37.5/1/deaDE365.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/017453c...ip/RdxIE601.cab
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://god.t-online.de/download/ExentCtl.ocx
O16 - DPF: {C94158E1-6151-4442-ABE6-FD53D6534EFB} (win32) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.com...bio5_3_18_0.cab


Starte neu und lösche die in den Einträgen vorkommenden Dateien. Erstelle ein neues Log, bitte komplett posten.

Hallo MountainKing

Danke für deine Hilfe

Ich habe zu erst die von eScan als Dialer angegebenen Dateien gelöscht, aber eine davon:
File E:\Swish v2.01.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken
die gehört zu einem Flash Programm. sollte ich die auch löschen ?

Dann habe ich den andern Einträgen gefixt und neugestartet.

Jetzt mein neues Logfile:




Logfile of HijackThis v1.98.2
Scan saved at 17:03:31, on 04.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://geocities.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://geocities.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.geocities.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 6\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 6\SnagItIEAddin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ToADiMon.exe] C:\Programme\T-Online\T-Online_Software_5\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C62 Series" /O5 "LPT1:" /M "Stylus C62"
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab28177.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab28177.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} - http://messenger.zone.msn.com/binary...reShowdown.cab

_____________________________________________________________

MfG.

Hallo Leute.

Habt ihr mein neues Log angeguckt ?
sieht es sauber aus oder was ist den ?


MfG

@Marlboro Light
da du keine prozesse gepostet hat, kann man zu den prozesse nichts sagen.
ansonsten schaut dein log sauber aus
chaosman

Hi Chaosman,

Folgende Prozesse laufen grade bei mir:

browser.exe
taskmgr.exe
PROFIL~1.EXE
sc_watch.exe
kernel.exe
msmsgs.exe
nvsvc32.exe
NPROTECT.EXE
Navpasvc.exe
ccApp.exe
SAgent.exe
Crypserv.exe
alg.exe
explorer.exe
NISUM.EXE
ccEvtMgr.exe
spoolsv.exe
svchost.exe
svchost.exe
svchost.exe
lsass.exe
services.exe
winlogon.exe
csrss.exe
ctfmon.exe
smss.exe
E_S10IC2.exe
svchost.exe
rundll32.exe
realshed.exe
ToADiMon.exe
System
Leerlaufprozess

................................

MfG