![]() |
Kann das mal jemand kontrollieren? Hallo ich wäre froh wenn sich jemand mal mein Logfile zur Kontrolle anschauen könnte ich kann damit nicht viel anfangen aber ich bin sicher irgendwas is nicht sauber... Im vornherein schon mal danke Logfile of HijackThis v1.97.7 Scan saved at 22:20:55, on 13.12.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\LEXBCES.EXE E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\system32\LEXPPS.EXE E:\WINDOWS\Explorer.EXE E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe E:\Programme\QuickTime\qttask.exe E:\Programme\Messenger Plus! 3\MsgPlus.exe E:\Programme\SED\SED.exe E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe E:\Programme\Lexmark X1100 Series\lxbkbmon.exe E:\PROGRA~1\eScan\TRAYICOS.EXE E:\PROGRA~1\eScan\AVPMWrap.EXE E:\WINDOWS\System32\ctfmon.exe E:\PROGRA~1\eScan\MAILDISP.EXE E:\Programme\MSN Messenger\msnmsgr.exe E:\PROGRA~1\eScan\MAILSCAN.EXE E:\PROGRA~1\eScan\SPOOLER.EXE E:\Programme\AVPersonal\AVWUPSRV.EXE E:\PROGRA~1\eScan\TRAYSSER.EXE E:\PROGRA~1\eScan\avpm.exe E:\WINDOWS\System32\svchost.exe E:\PROGRA~1\eScan\kavss.exe E:\PROGRA~1\eScan\AvpM.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\wuauclt.exe E:\Programme\Internet Explorer\iexplore.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\taskmgr.exe E:\WINDOWS\regedit.com F:\L&H Power Translator Pro\ptpro.exe E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe" O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background O9 - Extra button: PartyPoker.com (HKLM) O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM) O9 - Extra button: eBay - Homepage (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe |
|
Zitat:
|
@Passat2002 viellicht haben die den keller aufgeräumt... :aplaus: chaosman :D |
Wow hätte nicht gedacht das das so schnell geht. Hier die neue Logfile: Logfile of HijackThis v1.97.7 Scan saved at 23:29:44, on 13.12.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\LEXBCES.EXE E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\system32\LEXPPS.EXE E:\WINDOWS\Explorer.EXE E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe E:\Programme\QuickTime\qttask.exe E:\Programme\Messenger Plus! 3\MsgPlus.exe E:\Programme\SED\SED.exe E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe E:\Programme\Lexmark X1100 Series\lxbkbmon.exe E:\PROGRA~1\eScan\TRAYICOS.EXE E:\PROGRA~1\eScan\AVPMWrap.EXE E:\WINDOWS\System32\ctfmon.exe E:\PROGRA~1\eScan\MAILDISP.EXE E:\Programme\MSN Messenger\msnmsgr.exe E:\PROGRA~1\eScan\MAILSCAN.EXE E:\PROGRA~1\eScan\SPOOLER.EXE E:\Programme\AVPersonal\AVWUPSRV.EXE E:\PROGRA~1\eScan\TRAYSSER.EXE E:\PROGRA~1\eScan\avpm.exe E:\WINDOWS\System32\svchost.exe E:\PROGRA~1\eScan\kavss.exe E:\PROGRA~1\eScan\AvpM.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\wuauclt.exe E:\Programme\Internet Explorer\iexplore.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\taskmgr.exe E:\WINDOWS\regedit.com F:\L&H Power Translator Pro\ptpro.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe" O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background O9 - Extra button: PartyPoker.com (HKLM) O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM) O9 - Extra button: eBay - Homepage (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe |
äh sorry da hab ichs doch glatt nochmal vergeigt :lach: das sollte jetz das neue Log-File sein: Logfile of HijackThis v1.98.2 Scan saved at 23:37:37, on 13.12.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\LEXBCES.EXE E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\system32\LEXPPS.EXE E:\WINDOWS\Explorer.EXE E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe E:\Programme\QuickTime\qttask.exe E:\Programme\Messenger Plus! 3\MsgPlus.exe E:\Programme\SED\SED.exe E:\PROGRA~1\VBOUNCER\VirtualBouncer.exe E:\Programme\Lexmark X1100 Series\lxbkbmon.exe E:\PROGRA~1\eScan\TRAYICOS.EXE E:\PROGRA~1\eScan\AVPMWrap.EXE E:\WINDOWS\System32\ctfmon.exe E:\PROGRA~1\eScan\MAILDISP.EXE E:\Programme\MSN Messenger\msnmsgr.exe E:\PROGRA~1\eScan\MAILSCAN.EXE E:\PROGRA~1\eScan\SPOOLER.EXE E:\Programme\AVPersonal\AVWUPSRV.EXE E:\PROGRA~1\eScan\TRAYSSER.EXE E:\PROGRA~1\eScan\avpm.exe E:\WINDOWS\System32\svchost.exe E:\PROGRA~1\eScan\kavss.exe E:\PROGRA~1\eScan\AvpM.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\wuauclt.exe E:\Programme\Internet Explorer\iexplore.exe E:\WINDOWS\system32\rundll32.exe E:\WINDOWS\System32\taskmgr.exe E:\WINDOWS\regedit.com F:\L&H Power Translator Pro\ptpro.exe E:\WINDOWS\system32\NOTEPAD.EXE E:\WINDOWS\notepad.exe E:\Dokumente und Einstellungen\sascha\Desktop\Daniel stuff\Virenscanner\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ch/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://E:\PROGRA~1\Toolbar\toolbar.dll/sa R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O1 - Hosts: 69.20.16.183 ieautosearch O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O4 - HKLM\..\Run: [Lexmark X1100 Series] "E:\Programme\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [eDonkey2000] "E:\eDonkey2000\edonkey2000.exe" -t O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe" O4 - HKLM\..\Run: [eScan Updater] E:\PROGRA~1\eScan\TRAYICOS.EXE /App O4 - HKLM\..\Run: [eScan Monitor] E:\PROGRA~1\eScan\AVPMWrap.EXE O4 - HKLM\..\Run: [MCUpdateExe] E:\PROGRA~1\mcafee.com\agent\MCUPDATE.EXE O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MessengerPlus3] "E:\Programme\Messenger Plus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "E:\Programme\MSN Messenger\msnmsgr.exe" /background O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - E:\Programme\IrfanView\Ebay\Ebay.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\MSMSGS.EXE O10 - Broken Internet access because of LSP provider 'mwtsp.dll' missing O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe |
Warum eröffnest du einen sinnlosen zweiten Thread?! Wechsle in den abgesicherten Modus http://www.bsi.bund.de/av/texte/wiederher_xp.htm und fixe diese Einträge (Haken setzen und auf Fix Checked klicken): Alle R0, R1 und R3 Alle O1 O3 - Toolbar: IEMenuExtension toolbar - {6b95678d-30a4-4ff8-a72f-4208340c1f7f} - E:\Programme\IEMenuExtension\tbextn.dll O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file) O4 - HKLM\..\Run: [SESync] "E:\Programme\SED\SED.exe" O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file) O16 - DPF: ConferenceRoom Java Client - http://irc.bluewin.ch/java/cr.cab O16 - DPF: {FFCEABDA-C04E-7F4A-E9B6-DFA72B2F49FB} - http://213.200.210.10/dl/101/CH175_106.exe Diese Ordner löschen: E:\Programme\SED E:\PROGRA~1\VBOUNCER - mit eScan scannen - neue Startseite vergeben - Neustart - dein System updaten http://v5.windowsupdate.microsoft.co...r/default.aspx - IE sicherer konfigurieren und nur noch für das Windows Update benutzen http://www.datenschutzzentrum.de/sel...sie/config.htm oder http://www.blafusel.de/ie.html - Sichere und komfortablere Browser wie z.B. Mozilla oder Firefox verwenden http://www.mozilla.org - neues Log-File von HiJackThis und die Virus Log Information von eScan posten |
Danke für die schnelle Hilfe! sorry wegen des 2.Threads |
Alle Zeitangaben in WEZ +1. Es ist jetzt 10:32 Uhr. |
Copyright ©2000-2025, Trojaner-Board