Hallo,

AntiVir hat den Trojaner "TR/Dldr.Small.OR" gefunden, der lässt sich aber nicht löschen. Desweiteren teilt mir AntiVir jetzt bei jedem Aufruf mit, dass im Master-Bootsektor der Festplatte HD0 Code von "TR/StartPage.QC.1" gefunden wurde und dass dieses Programm nicht entfernbar ist. Danach wird AntiVir sofort beendet.

Das ist mein Logfile. Ich hoffe, es kann mir jemand helfen.

Logfile of HijackThis v1.98.2
Scan saved at 20:29:08, on 15.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Startup: Joint Operations Typhoon Rising Produktregistrierung.lnk = C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{472677A5-0244-4B39-AE59-9D03EDD5F12D}: NameServer = 62.27.27.62 62.27.53.66
O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} - C:\WINDOWS\System32\vbsys.dll



Danke schon mal,
Jadefox

Lösche diese Dateien im abges. Modus:

C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
C:\WINDOWS\System32\vbsys.dl

Fixe mit HijackThis dies:

O4 - Startup: Joint Operations Typhoon Rising Produktregistrierung.lnk =
C:\Dokumente und Einstellungen\Stefanie\Lokale
Einstellungen\Temp\{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O21 - SSODL: SystemCheck - {54645654-2225-4455-44A1-9F4543D34544} -
C:\WINDOWS\System32\vbsys.dl


Lösche deine Temp. Internet Files.

Hallo,

Die Datei habe ich nicht gefunden und konnte sie somit auch nicht löschen, in HijackThis konnte ich sie fixen:

C:\Dokumente und Einstellungen\Stefanie\Lokale Einstellungen\Temp\
{0C9187BF-180B-4A30-AA9B-8344FC82B00D}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE

Das neue Logfile sieht so aus:

Logfile of HijackThis v1.98.2
Scan saved at 15:39:08, on 16.10.2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Programme\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE

Vielen Dank,

Jadefox

Schaut sauber aus.

Leere deinen Temp-Ordner.

Installiere SP2!

Hab mit www.windowsupdate.com alles installiert. Temp + Temporary Internet Files geleert.

AntiVir meldet immer noch den Trojaner TR/StartPage.QC.1 und beendet sich dann.
Sollte ich das Virenprogramm vielleicht runterschmeißen und neu installieren?

Gruß, Jadefox

Nein.

Scanne mal hiermit im abgesicherten Modus: http://www.trojaner-board.de/42731-escan-anleitung.html

Poste anschließend wo und was gefunden wurde.

@ Jadefox

wenn Du den eScan durchgeführt hast, kannst Du die Einträge folgendermassen posten: "Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forumübertragen"

oder löschen, aber bitte im abgesicherten Modus, bei deaktivierter Systemwiederherstellung:

"Öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren undin die Windows Suche übertragen -> löschen!" Nach dem Löschen bitte die Systemwiederherstellung aktivieren und in den normalen Modus booten.

SD

Hallo,
das ist, was escan gefunden hat. Infected gab's nicht, aber unten in der Übersicht stand, dass er 65 Viruse gefunden hat... Der Rest war "Size Restriction". Hat das was zu bedeuten? Ich hab die nicht alle hier gepostet, das wäre zu viel gewesen.

Tue Oct 19 08:18:58 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:19:00 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:03 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0102.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0202.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0300a.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:19:19 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:19:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0302.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0600a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:10 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:12 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0602.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:20:12 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\0603.dlm having Size Restriction ***

Tue Oct 19 08:20:19 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0700a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0701.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0702.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:20:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:20:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0900a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:20:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0901.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:06 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:14 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1102.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:21:22 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1202.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:29 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:32 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1302.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:21:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1501.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:21:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:00 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:01 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1701.DLM tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
Tue Oct 19 08:22:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1799.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.

Tue Oct 19 08:22:10 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1800.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:11 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:11 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\1802.dlm having Size Restriction ***

Tue Oct 19 08:22:14 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1900.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1901.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:15 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\1902.dlm having Size Restriction ***

Tue Oct 19 08:22:15 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1999.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:18 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:18 2004 => *** File D:\Daniel\GTA Vice City Cars\DHL\2002.dlm having Size Restriction ***

Tue Oct 19 08:22:22 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2100.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:22 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM
Tue Oct 19 08:22:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:32 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2201.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:22:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2300.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:22:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2501.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Tue Oct 19 08:23:01 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2601.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:03 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2701.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:03 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM
Tue Oct 19 08:23:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:07 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM
Tue Oct 19 08:23:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.

Tue Oct 19 08:23:08 2004 => Scanning File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM
Tue Oct 19 08:23:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

@ Jadefox,

such bitte aus dem eScan Log all die Dateien raus, bei denen steht:

infected by "xxx" Virus. Action Taken: No Action Taken
tagged as not-a-virus:AdWare

poste vorallem die Einträge, die einen "Virus" zu erkennen geben.

SD

Hi,
escan hat nichts mit "infected" gefunden. Die einzigen Einträge, die als Virus in der Statistik am Ende angegeben wurden sind die hier:

Sat Oct 23 12:40:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:40:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0102.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0202.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0300a.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:40:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:40:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0302.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:02 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:07 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0402.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:41:26 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0502.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:45 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0600a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:46 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0602.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:41:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0700a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0701.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:41:56 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0702.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:42:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:42:08 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0800a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0900a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:25 2004 => File D:\Daniel\GTA Vice City Cars\DHL\0901.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:38 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1000a.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:41 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1100a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:49 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1102.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:42:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1200a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1201.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:42:59 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1202.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:02 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1300a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:04 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:05 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1302.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:09 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1400a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:20 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1501.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:28 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:33 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1600a.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1601.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1701.DLM tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
Sat Oct 23 12:43:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1799.dlm tagged as not-a-virus:Cracker.AssasinPatch. No Action Taken.
Sat Oct 23 12:43:43 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1800.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:44 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1801.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:47 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1900.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1901.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:48 2004 => File D:\Daniel\GTA Vice City Cars\DHL\1999.dlm tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:43:51 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2001.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:55 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2100.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:43:58 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2101.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:05 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2201.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:44:11 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2300.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:13 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2301.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:31 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2501.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.
Sat Oct 23 12:44:34 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2601.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:36 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2701.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2800.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:39 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2801.dlm tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:40 2004 => File D:\Daniel\GTA Vice City Cars\DHL\2900.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:41 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3000.DLM tagged as not-a-virus:Cracker.Game.HotHook. No Action Taken.
Sat Oct 23 12:44:42 2004 => File D:\Daniel\GTA Vice City Cars\DHL\3100.DLM tagged as not-a-virus:Cracker.Game.HotHook.dll. No Action Taken.

Sonst wurde nichts gefunden.

Jade

Hallo Jadefox,

einer der seltenen Fälle, dass ich etwas ratlos dreinschaue. Du könntest nun natürlich den Ordner File D:\Daniel\GTA Vice City Cars\DHL\ leeren. Aber 'not-a-virus:Cracker.Game.HotHook. ' sagt mir garnichts. Mal sehen, ob die anderen damit etwas anfangen können.

Poste bitte noch ein Hijack This Logfile.

SD

Hier ist das Logfile. Bin am überlegen, ob ich nicht einfach den PC formatiere. Dann wär der Trojaner auch auf jeden Fall weg :-)...

Logfile of HijackThis v1.98.2
Scan saved at 17:14:17, on 24.10.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programme\AVPersonal\AVGUARD.EXE
D:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\PRISMSTA.EXE
D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
D:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
D:\Programme\Telekom\Eumex 404PC\Capictrl.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programme\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C84 Series" /O5 "LPT1:" /M "Stylus C84"
O4 - HKLM\..\Run: [Zone Labs Client] "D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVGCtrl] D:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: CAPIControl.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{472677A5-0244-4B39-AE59-9D03EDD5F12D}: NameServer = 62.27.27.62 62.27.53.66

Hallo Jadefox,

boote in den abgesicherten Modus, deaktiviere die Systemwiederherstellung, und fixe dann mit Hijack This (Häkchen setzen und fix checked klicken):

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

Boote in den normalen Modus. Aktiviere die Systemwiederherstellung.

vergleiche hierzu die automatische Auswertung

Gibt Dein AntiVirenProgramm einen Pfad an, WO sich der Virus befindet?

SD

Hi,
ich glaube, jetzt ist der Virus weg. Es wurde von AntiVir in einem Fehlermeldefenster ein Pfad angezeigt, in dem sich der TR/StartPage.QC.1 befunden hat. Darunter waren verschiedene Optionen, u.a. auch löschen. Wenn man das mit deaktivierter Systemwiederherstellung gemacht hat, konnte man AntiVir wieder ohne Fehlermeldung starten. Bin grad dabei, ein Update für AntiVir runterzuladen, danach werde ich es mal übers System laufen lassen. Dann meld ich mich nochmal.
Vielen Dank schon mal für die ganze Mühe!!!!!

Gruß, Jadefox

Anscheinend ist der Virus jetzt tatsächlich weg. Danke nochmal für alles!!

Jade