|
Log-Analyse und Auswertung: TR/Crypt.XPACK.Gen und JAVA/Agent.BHWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.09.2010, 15:56 | #1 |
| TR/Crypt.XPACK.Gen und JAVA/Agent.BH Hallo, ich hatte vor einigen Tagen Probleme mit diesen Zwei Gesellen. Der Avira AntiVir zeigt zwar jetzt nichts mehr an, es gibt aber immer noch Probleme. Hier ist mein Hijackthis.log: --------------------------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 16:48:14, on 29.09.2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\WINNT\System32\GEARSec.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINNT\system32\nvsvc32.exe M:\TV\Version5\TeamViewer_Service.exe D:\Programme\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe C:\Programme\Windows Home Server\WHSConnector.exe C:\WINNT\Explorer.EXE M:\TV\Version5\TeamViewer.exe C:\Programme\T-DSL Business\bolog.exe C:\WINNT\Mixer.exe C:\WINNT\SOUNDMAN.EXE C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe D:\Programme\ICQ6.5\ICQ.exe C:\Programme\Java\jre6\bin\jucheck.exe C:\Programme\Mozilla Firefox\firefox.exe c:\programme\avira\antivir desktop\avcenter.exe C:\WINNT\system32\notepad.exe C:\Programme\Mozilla Firefox\plugin-container.exe C:\WINNT\Profiles\sandy\Eigene Dateien\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll O2 - BHO: BrowserHelper Class - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Programme\Windows Home Server\WHSDeskBands.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll O2 - BHO: (no name) - {CA356D79-679B-4b4c-8E49-5AF97014F4C1} - C:\Programme\Starware357\bin\Starware357.dll (file missing) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Starware Rezepte-Toolbar - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Programme\Starware357\bin\Starware357.dll (file missing) O3 - Toolbar: Home Server Banner - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Programme\Windows Home Server\WHSDeskBands.dll O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe O4 - HKLM\..\Run: [BusinessOnline Log] "C:\Programme\T-DSL Business\bolog.exe" O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [LexwareInfoService] C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe /autostart O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [ICQ] "d:\Programme\ICQ6.5\ICQ.exe" silent O4 - HKUS\S-1-5-18\..\Run: [Microsoft Update] vpc32.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft Update] vpc32.exe (User 'Default user') O4 - Global Startup: Windows Home Server.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing) O13 - WWW. Prefix: hxxp:// O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - hxxp://fdl.msn.com/public/chat/msnchat41.cab O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - hxxp://62.39.141.134/tools/FlipsideWebLauncherControl.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - hxxp://game16.zylomgames.com/activex/zylomloader.cab O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - hxxp://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A4D23CA2-87D9-45D9-9812-F53A8D942E59}: NameServer = 93.188.162.82,93.188.161.222 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222 O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\System32\browseui.dll O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\ati2plxx.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINNT\System32\GEARSec.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - M:\TV\Version5\TeamViewer_Service.exe O23 - Service: V2i Protector - PowerQuest Corporation - D:\Programme\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe -- End of file - 7143 bytes --------------------------------------------------------------------- Irgendwelche Vorschläge? |
30.09.2010, 09:56 | #2 |
| TR/Crypt.XPACK.Gen und JAVA/Agent.BH Hi.
__________________Deine Internetverbindung wird über die Ukraine geroutet und da ist noch was... Bitte folgende Files prüfen: Dateien Online überprüfen lassen:
Code:
ATTFilter c:\windows\vpc32.exe oder c:\windows\system32\vpc32.exe
Hijackthis, fixen: öffne das HijackThis -- Button "scan" -- vor den nachfolgenden Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Beim fixen müssen alle Programme geschlossen sein! (Falls vorhanden, Teatimer von Spyboot wie folgt deaktivieren: Modus-->Erweiterte Modus-->Ja-->Werkzeuge-->Resident-->dHäkchen entfernen aus der "Resident "TeaTimer" (Schutz aller Systemeinstellungen)->exit) Code:
ATTFilter O17 - HKLM\System\CCS\Services\Tcpip\..\{A4D23CA2-87D9-45D9-9812-F53A8D942E59}: NameServer = 93.188.162.82,93.188.161.222 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.82,93.188.161.222 O13 - WWW. Prefix: hxxp:// O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing) O4 - HKUS\S-1-5-18\..\Run: [Microsoft Update] vpc32.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Microsoft Update] vpc32.exe (User 'Default user') O4 - Global Startup: Windows Home Server.lnk = ? O3 - Toolbar: Starware Rezepte-Toolbar - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - C:\Programme\Starware357\bin\Starware357.dll (file missing) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ R3 - URLSearchHook: (no name) - - (no file) Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen: http://filepony.de/download-chameleon/ Danach bitte update der Signaturdateien (Reiter "Update" -> Suche nach Aktualisierungen") Fullscan und alles bereinigen lassen! Log posten. OTL Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop
TDSS-Killer Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft? Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)! Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe. Nach dem Start erscheint ein Fenster, dort dann "Start Scan". Wenn der Scan fertig ist bitte "Report" anwählen. Es öffnet sich ein Fenster, den Text abkopieren und hier posten... chris
__________________ |
30.09.2010, 14:00 | #3 |
| TR/Crypt.XPACK.Gen und JAVA/Agent.BH MBAM brachte einiges zu Tage:
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4052 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 30.09.2010 13:49:21 mbam-log-2010-09-30 (13-49-21).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|M:\|) Durchsuchte Objekte: 216744 Laufzeit: 35 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 7 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 58 Infizierte Dateien: 92 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca356d79-679b-4b4c-8e49-5af97014f4c1} (Adware.Starware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\starware357 (Adware.Starware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\starware357 (Adware.Starware) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{d49e9d35-254c-4c6a-9d17-95018d228ff5} (Adware.Starware) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.82,93.188.161.222 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{a4d23ca2-87d9-45d9-9812-f53a8d942e59}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.82,93.188.161.222 -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357 (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\contexts (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357 (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\BrowserSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Configurator (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ErrorSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Layouts (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Manager (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RecipeSearch_Foreign (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Recipes_Foreign (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RelatedSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Toolbar (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarLogo (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\TravelSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357 (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\BrowserSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Configurator (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ErrorSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Layouts (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Manager (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RecipeSearch_Foreign (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Recipes_Foreign (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RelatedSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images\active (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images\default (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Toolbar (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarLogo (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\TravelSearch (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357 (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\bin (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\icons (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\system32\drivers\etc\download (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Dateien: C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\FindIt.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\FindItHot.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\findithotxp.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\finditxp.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\Highlight.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\HighlightHot.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\highlighthotxp.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\highlightxp.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\recipes.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\recipes.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\recipes_foreign_feed.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\recipes_foreign_feed.png (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\buttons\starware_toolbar_icon.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\contexts\error.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\contexts\Related.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\contexts\Travel.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\ProductMessagingConfig.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\ProductMessagingConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\SimpleUpdateConfig.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\SimpleUpdateConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\TimerManagerConfig.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\All Users\Anwendungsdaten\Starware357\SimpleUpdate\TimerManagerConfig.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\BrowserSearch\BrowserSearch.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\BrowserSearch\BrowserSearch.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Configurator\Configurator.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Configurator\Configurator.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ErrorSearch\ErrorSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ErrorSearch\ErrorSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\GamesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\GamesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Games\images\active\Games0.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Layouts\PreferencesLayout.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Layouts\PreferencesLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Layouts\ToolbarLayout.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Layouts\ToolbarLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Manager\ManagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Manager\ManagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\MoviesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\MoviesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Movies\images\active\Movies0.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Recipes_Foreign\Recipes_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Recipes_Foreign\Recipes_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RelatedSearch\RelatedSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\RelatedSearch\RelatedSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\images\active\ScreensaversMarketingSitePager0.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Toolbar\TBProductsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\Toolbar\TBProductsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarLogo\ToolbarLogoOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarLogo\ToolbarLogoOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarSearch\ToolbarSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\ToolbarSearch\ToolbarSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\TravelSearch\TravelSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\sandy\Anwendungsdaten\Starware357\TravelSearch\TravelSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\BrowserSearch\BrowserSearch.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\BrowserSearch\BrowserSearch.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Configurator\Configurator.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Configurator\Configurator.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ErrorSearch\ErrorSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ErrorSearch\ErrorSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games\GamesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Games\GamesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Layouts\ToolbarLayout.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Layouts\ToolbarLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Manager\ManagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Manager\ManagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies\MoviesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Movies\MoviesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RecipeSearch_Foreign\RecipeSearch_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Recipes_Foreign\Recipes_ForeignOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Recipes_Foreign\Recipes_ForeignOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RelatedSearch\RelatedSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\RelatedSearch\RelatedSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ScreensaversMarketingSitePager\ScreensaversMarketingSitePagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Toolbar\TBProductsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\Toolbar\TBProductsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarLogo\ToolbarLogoOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarLogo\ToolbarLogoOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarSearch\ToolbarSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\ToolbarSearch\ToolbarSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\TravelSearch\TravelSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\WINNT\Profiles\Administrator.002\Anwendungsdaten\Starware357\TravelSearch\TravelSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\brand.bmp (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\Starware357Config.xml (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\Thumbs.db (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\icons\star_16.ico (Adware.Starware) -> Quarantined and deleted successfully. C:\Programme\Starware357\icons\Thumbs.db (Adware.Starware) -> Quarantined and deleted successfully. Damit möchte ich jetzt auch schliessen. (Ist nicht mein Rechner ) |
30.09.2010, 14:50 | #4 |
| TR/Crypt.XPACK.Gen und JAVA/Agent.BH Hi, wie Du meinst... chris
__________________ Don't bring me down Vor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
Themen zu TR/Crypt.XPACK.Gen und JAVA/Agent.BH |
adobe, antivir, antivir guard, avira, bho, desktop, excel, explorer, firefox, google, hijack, hkus\s-1-5-18, home, internet, internet explorer, java/agent.bh, lexware, mozilla, nvidia, object, pdf, plug-in, rundll, server, software, system, tr/crypt.xpack.ge, tr/crypt.xpack.gen, windows, windows xp |