|
Internet stops Hiho, habe da ein Problem ich sürfe ganz normal im Internet und dann bleibt es für paar Sekunden hängen und dann geht es ganz normal weiter usw. kann das ein Virus oder in der art sein?? |
Hallo, möglicherweise könnte dieses Verhalten auf Malware hinweisen. Erstelle mit HiJackThis ein Log-File und poste es hier rein. Persönliche Informationen, wie Benutzername und dergleichen, bitte unkenntlich machen. |
Logfile of HijackThis v1.98.2 Scan saved at 13:55:59, on 05.12.2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\system32\CTsvcCDA.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\ATI-CPanel\atiptaxx.exe C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\PROGRA~1\Java\J2RE14~1.2\bin\jusched.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\NaviSearch\bin\nls.exe C:\Programme\BullsEye Network\bin\bargains.exe C:\WINDOWS\system32\rundll32.exe C:\Programme\CashBack\bin\cashback.exe C:\Programme\Web_Rebates\WebRebates0.exe C:\progra~1\2findm~1\partner\saap.exe C:\WINDOWS\system32\CTHELPER.EXE C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\ICQLite\ICQLite.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\Web Offer\wo.exe C:\Programme\U.S. Robotics\SureConnect ADSL Utility\USRSureConnect.exe C:\Programme\OnlineCounter 2004\OnlineCounter.exe C:\Programme\Web_Rebates\WebRebates1.exe C:\WINDOWS\system32\wuauclt.exe C:\Programme\Real\RealPlayer\RealPlay.exe C:\Programme\Teamspeak2_RC2\TeamSpeak.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Dokumente und Einstellungen\Anton.50-W59O8MTQKBSV\Desktop\hijackthis1982\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ruserv.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.ruserv.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tetki.ru/index5.shtml R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ruserv.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.ruserv.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tetki.ru/index5.shtml R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.ruserv.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.ruserv.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freenet.de/ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file) O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Programme\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programme\NewDotNet\newdotnet6_38.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar3_28.dll O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file) O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programme\TGTSoft\StyleXP\TGT_BHO.dll O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717177657972} - C:\WINDOWS\System32\qwe7972.dll O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717177658264} - (no file) O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765721306} - C:\WINDOWS\System32\wer1306.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll O3 - Toolbar: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar3_28.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\PROGRA~1\Java\J2RE14~1.2\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NaviSearch] C:\Programme\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Programme\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKLM\..\Run: [CashBack] C:\Programme\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [Blubster] C:\Programme\Blubster\Blubster.exe SILENT O4 - HKLM\..\Run: [WebRebates0] "C:\Programme\Web_Rebates\WebRebates0.exe" O4 - HKLM\..\Run: [saap] c:\progra~1\2findm~1\partner\saap.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Programme\Creative\SBLive\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [mtkrwj] C:\WINDOWS\mtkrwj.exe O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s O4 - HKLM\..\Run: [IP Changer 2.0] "C:\Programme\Plustech Inc\IP Changer 2.0\IPChanger.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SIDEBAR] C:\WINDOWS\Resources\Themes\DameK UltraBlue\Desktop Sidebar\sidebar.exe O4 - HKCU\..\Run: [STYLEXP] C:\Programme\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Steam] C:\Programme\Steam.exe -silent O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: OnlineCounter 2004-Autostart.lnk = C:\Programme\OnlineCounter 2004\OnlineCounter-Autostart.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: U.S. Robotics SureConnect ADSL-Dienstprogramm.lnk = ? O8 - Extra context menu item: Download with NetPumper - C:\Programme\NetPumper\AddUrl.htm O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O8 - Extra context menu item: Web Savings - file://C:\Programme\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - (no file) O9 - Extra button: concept/design's onlineTV - {895B1991-F613-4DBE-9BCD-29D1C200E1F1} - C:\Programme\onlineTV\onlineTV.exe O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O10 - Hijacked Internet access by New.Net O10 - Broken Internet access because of LSP provider 'osmim.dll' missing O13 - DefaultPrefix: O13 - WWW Prefix: http://turboinet.com/r.cgi? O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://c:\nosuch.mht!http://www.terra.es/personal9/eropli...chm::/file.exe O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softwa...6_download.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1094228971906 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{602541B6-FAC1-44E6-8FAD-2A4C18D7DAF6}: NameServer = 194.97.173.124 194.97.173.125 |
Das eScan AntiVirus Toolkit Utility (mwav.exe) herunterladen, die Datei in den Ordner "c:\bases" (wichtig !) entpacken und danach die "kavupd.exe" (Update) ausführen. http://www.mwti.net/antivirus/free_utilities.asp Wechsle in den abgesicherten Modus http://www.bsi.bund.de/av/texte/wiederher_xp.htm und deinstalliere unter Software New.net oder Newdotnet. Fixe diese Einträge (Haken setzen und auf Fix Checked klicken): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ruserv.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.ruserv.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tetki.ru/index5.shtml R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.ruserv.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.ruserv.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tetki.ru/index5.shtml R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.ruserv.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.ruserv.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.freenet.de/ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file) O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Programme\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Programme\NewDotNet\newdotnet6_38.dll O2 - BHO: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar3_28.dll O2 - BHO: (no name) - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - (no file) O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717177657972} - C:\WINDOWS\System32\qwe7972.dll O2 - BHO: (no name) - {CF021F40-3E14-23A5-CBA2-717177658264} - (no file) O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-717765721306} - C:\WINDOWS\System32\wer1306.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll O3 - Toolbar: QuickSearch SearchBar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Programme\QuickSearch\QuickSearchBar3_28.dll O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O4 - HKLM\..\Run: [NaviSearch] C:\Programme\NaviSearch\bin\nls.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Programme\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s O4 - HKLM\..\Run: [CashBack] C:\Programme\CashBack\bin\cashback.exe O4 - HKLM\..\Run: [Blubster] C:\Programme\Blubster\Blubster.exe SILENT O4 - HKLM\..\Run: [WebRebates0] "C:\Programme\Web_Rebates\WebRebates0.exe" O4 - HKLM\..\Run: [saap] c:\progra~1\2findm~1\partner\saap.exe O4 - HKLM\..\Run: [mtkrwj] C:\WINDOWS\mtkrwj.exe O8 - Extra context menu item: Web Rebates - file://C:\Programme\Web_Rebates\Sy1150\Tp1150\scri1150a.htm O8 - Extra context menu item: Web Savings - file://C:\Programme\WebSavingsfromEbates\System\Temp\ebat eswebsavings_script0.htm O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - (no file) O10 - Hijacked Internet access by New.Net O10 - Broken Internet access because of LSP provider 'osmim.dll' missing O13 - DefaultPrefix: O13 - WWW Prefix: http://turboinet.com/r.cgi? O16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://c:\nosuch.mht!http://www.terra.es/personal9/eropl....chm::/file.exe O16 - DPF: {12398DD6-40AA-4C40-A4EC-A42CFC0DE797} (Installer Class) - http://www.xxxtoolbar.com/ist/softw...06_download.cab Lösche diese Dateien: Ordner C:\Programme\Web_Rebates Ordner C:\PROGRA~1\NEWDOT~1 Ordner C:\Programme\CashBack Ordner C:\Programme\Blubster Ordner c:\progra~1\2findm~1 Ordner C:\Programme\BullsEye Network C:\WINDOWS\System32\wer1306.dll Ordner C:\Programme\MyWay Ordner C:\Programme\QuickSearch C:\WINDOWS\system32\msbe.dll C:\WINDOWS\system32\nvms.dll C:\WINDOWS\system32\mscb.dll C:\WINDOWS\System32\qwe7972.dll - mit eScan scannen (den Scanner mit der "mwavscan.com" starten. Alle Häkchen setzen und "Scan" klicken.) und die Malware manuell entfernen http://www.trojaner-board.de/42731-escan-anleitung.html - interne Verbindungsfirewall aktivieren http://www.computerhilfe-euskirchen....xp/tipp16.html - Neustart - dein System updaten http://v5.windowsupdate.microsoft.co...r/default.aspx - IE sicherer konfigurieren und nur noch für das Windows Update benutzen http://www.datenschutzzentrum.de/sel...sie/config.htm oder http://www.blafusel.de/ie.html - Sichere und komfortablere Browser wie z.B. Mozilla oder Firefox verwenden http://www.mozilla.org - neues Log-File von HiJackThis und die Virus Log Information von eScan posten |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 12:31 Uhr. |
Copyright ©2000-2025, Trojaner-Board