Prob. mit NIS2002 u. CWshredder

kesrith

Hallo & Gruss...zum 2ten:
...seit einerCWshredder Versionsprüfung spinnt meine Norton-FW (NIS2002/NAV2004).
Ich bekam dann von CWshredder folgende Meldung:
"Ich hätte eine Variante des CW-Trojaners > CWS.smartsearch.2 < mit der Funktion, CWshredder zu schliesen" (siehe Bilder)

nach "OK"-Click dann folgendes: Coolwebsearch not found bla-bla...
aber meine FW wird immer noch ab u. an deaktiviert.
Hier sind meine Logfiles von Hijackthis & Cwshredder, ich wäre dankbar für eure Hilfe.
aufgefallen ist mir eine Datei: avsniff.dll
kennt die jemand ?

Gruss & Danke i.V. für Eure Hilfe ....kesrith

Logfile HijackThis v1.98.2

Scan saved at 14:12:15, on 05.11.2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
......
L:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
L:\Programme\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
L:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
L:\PROGRA~3\TEXTER~1\Bin\INSTAN~1.EXE
L:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
L:\WINDOWS\system32\ctfmon.exe
L:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\wkcalrem.exe
L:\PROGRA~1\Symantec\NORTON~1\GHOSTS~2.EXE
L:\Programme\Norton AntiVirus\navapsvc.exe
L:\Programme\Norton Internet Security\NISUM.EXE
L:\Programme\Norton AntiVirus\SAVScan.exe
L:\WINDOWS\system32\svchost.exe
L:\Programme\Norton Internet Security\SymProxySvc.exe
L:\Programme\Norton Internet Security\NISSERV.EXE
L:\Programme\Gemeinsame Dateien\Symantec Shared\Security Center\SymWSC.exe
L:\Programme\T-DSL SpeedManager\tsmsvc.exe
L:\WINDOWS\system32\wscntfy.exe
L:\Programme\Norton Internet Security\IAMAPP.EXE
L:\Programme-antispy-04\HiJackThis\hijackthis_198\HijackThis.exe
L:\Programme\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - L:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - L:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - L:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [iamapp] L:\Programme\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [Microsoft Works Portfolio] L:\Programme\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] L:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "L:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] L:\Programme\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] L:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] L:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [HotKey] L:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKLM\..\Run: [InstantAccess] l:\PROGRA~3\TEXTER~1\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] l:\PROGRA~3\TEXTER~1\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [WinampAgent] "L:\Programme-2\MEDIAPLAYER\WinAmp_291c_de_install\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [NeroCheck] L:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "L:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [RegisterDropHandler] l:\PROGRA~3\TEXTER~1\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] L:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "L:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: Erinnerungen in Microsoft Works-Kalender.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = L:\Programme\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - L:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - L:\Programme\Messenger\msmsgs.exe
O15 - Trusted Zone: www.microsoft.de
O15 - Trusted Zone: http://www.microsoft.de
O15 - Trusted Zone: http://security.symantec.com
O15 - Trusted Zone: www.symantec.com
O15 - Trusted Zone: http://www.symantec.com
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1099596731018
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/tech...a/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/tech...ActiveData.cab


Logfile CWshredder 05.11.2004 :
**** Run Keys ****
RUN: [iamapp] L:\Programme\Norton Internet Security\IAMAPP.EXE
RUN: [Microsoft Works Portfolio] L:\Programme\Microsoft Works\WksSb.exe /AllUsers
RUN: [Microsoft Works Update Detection] L:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
RUN: [T-DSL SpeedMgr] "L:\Programme\T-DSL SpeedManager\SpeedMgr.exe"
RUN: [GhostStartTrayApp] L:\Programme\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
RUN: [SunJavaUpdateSched] L:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
RUN: [HPDJ Taskbar Utility] L:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe
RUN: [HotKey] L:\WINDOWS\Twain_32\FlatBed\HotKey.exe
RUN: [InstantAccess] l:\PROGRA~3\TEXTER~1\Bin\INSTAN~1.EXE /h
RUN: [RegisterDropHandler] l:\PROGRA~3\TEXTER~1\Bin\REGIST~1.EXE
RUN: [WinampAgent] "L:\Programme-2\MEDIAPLAYER\WinAmp_291c_de_install\Winamp\Winampa.exe"
RUN: [NeroCheck] L:\WINDOWS\system32\NeroCheck.exe
RUN: [ccApp] "L:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
RUN: [CTFMON.EXE] L:\WINDOWS\system32\ctfmon.exe
RUN: [MSMSGS] "L:\Programme\Messenger\msmsgs.exe" /background


**** Browser Helper Objects ****
BHO: [AcroIEHlprObj Class] L:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
BHO: [CNavExtBho Class] L:\Programme\Norton AntiVirus\NavShExt.dll

**** IE Toolbars ****

TOOLBAR: [Norton AntiVirus] L:\Programme\Norton AntiVirus\NavShExt.dll

**** IE Extensions ****

IEExt: [Messenger] L:\Programme\Messenger\msmsgs.exe

**** Hosts File Entries ****

HOSTS: 127.0.0.1 localhost
HOSTS: 127.0.0.1 localhost

**** IE Settings ****

Default Page: http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
Default Search: http://www.microsoft.com/isapi/redir...ie&ar=iesearch
Search Page: http://www.microsoft.com/isapi/redir...ie&ar=iesearch

**** IE Context Menu (Right click) ****

**** Layered Service Providers ****

LSP: MSAFD Tcpip [TCP/IP]
LSP: MSAFD Tcpip [UDP/IP]
LSP: RSVP UDP Service Provider
LSP: RSVP TCP Service Provider
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{132DA74D-F306-4939-8A0F-8F95D03EB970}] SEQPACKET 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{132DA74D-F306-4939-8A0F-8F95D03EB970}] DATAGRAM 0
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{E9781A19-F7D3-44A5-9F7B-9B59344B0DCC}] SEQPACKET 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{E9781A19-F7D3-44A5-9F7B-9B59344B0DCC}] DATAGRAM 1
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3FEA5A32-6BAA-491A-A8DB-EAD6113F9E97}] SEQPACKET 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{3FEA5A32-6BAA-491A-A8DB-EAD6113F9E97}] DATAGRAM 2
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F1CF893-3FCA-4D2D-B583-49E010EA5DD7}] SEQPACKET 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F1CF893-3FCA-4D2D-B583-49E010EA5DD7}] DATAGRAM 3
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{90DA39BD-71F9-455F-B9FE-286D6D674552}] SEQPACKET 4
LSP: MSAFD NetBIOS [\Device\NetBT_Tcpip_{90DA39BD-71F9-455F-B9FE-286D6D674552}] DATAGRAM 4

**** Blocked Control Panel Items ****

BLOCKED: [ncpa.cpl] No
BLOCKED: [odbccp32.cpl] No

**** Downloaded Program Files ****

{2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} [http://security.symantec.com/sscv6/S...n/AvSniff.cab] L:\WINDOWS\Downloaded Program Files\navapi.vxd L:\WINDOWS\Downloaded Program Files\navapi32.dll L:\WINDOWS\Downloaded Program Files\avsniff.dll
{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} [http://office.microsoft.com/officeup...tent/opuc.cab]
{6414512B-B978-451D-A0D8-FCFDF33E833C} [http://v5.windowsupdate.microsoft.co...1099596731018]
{644E432F-49D3-41A1-8DD5-E099162EEEC5} [http://security.symantec.com/sscv6/S...bin/cabsa.cab]
{8AD9C840-044E-11D1-B3E9-00805F499D93} [http://java.sun.com/products/plugin/...dows-i586.cab]
{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} [http://java.sun.com/products/plugin/...dows-i586.cab]
{CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} [https://www-secure.symantec.com/tech.../SymAData.cab]
{D27CDB6E-AE6D-11CF-96B8-444553540000} [http://fpdownload.macromedia.com/pub...h/swflash.cab]
{E77C0D62-882A-456F-AD8F-7C6C9569B8C7} [https://www-secure.symantec.com/tech...ctiveData.cab]

**** Custom IE Search Items ****

SEARCH: [SearchAssistant] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SEARCH: [CustomizeSearch] http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

Miniaturansicht angehängter Grafiken