|
Trojaner/Startseite about blank Hab das Problem, das hier schon einige hatten. Beim starten des IE kommt immer about blank als startseite, mit dieser seite search for.. naja, hatte mir erst SpHjfix.exe runtergeladen und ausführen lassen, doch stand da, dass nichts infiziert sei. Dann hab ich hijackthis starten lassen, weil irgendwo stand, dass man das probieren soll, wenn angeblich nichts infiziert ist. da hab ich dann gelöscht, was auf der startseite stand, aber irgendwie veschwindets dann nie ganz, hab hier die logfile und würde gerne wissen, was ich löschen muss.. Logfile of HijackThis v1.99.0 Scan saved at 17:42:34, on 28.01.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\NavExcel\NavHelper\v2.0.4d\navapp.exe C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe C:\WINDOWS\System32\P2P Networking\P2P Networking.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\nvsvc32.exe C:\Programme\Gemeinsame Dateien\GMT\GMT.exe C:\PROGRA~1\FlashGet\flashget.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Dokumente und Einstellungen\thorsten\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\thorsten\LOKALE~1\Temp\sp.dll/sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\thorsten\LOKALE~1\Temp\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll (file missing) O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Programme\NavExcel\NavHelper\v2.0.4d\NHelper.dll O2 - BHO: (no name) - {E7E199D8-A419-4775-BD55-BF2F38FA5E44} - C:\WINDOWS\System32\opacao.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [navapp] C:\Programme\NavExcel\NavHelper\v2.0.4d\navapp.exe O4 - HKLM\..\Run: [CMESys] "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe" O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - Global Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Alles mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Backward &Links - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Ebates - file://C:\Programme\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm O8 - Extra context menu item: Mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Programme\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU) O9 - Extra button: Ebates - {7F241C00-DAB6-11d5-AAA8-0001028DF1BC} - file://C:\Programme\EbatesMoeMoneyMaker\System\Temp\ebates_script0.htm (file missing) (HKCU) O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/0766c75c74f6984...dxIE601_de.cab O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/acontix.cab O18 - Filter: text/html - {7A0BD340-051A-42BB-80C3-9E5F0CD864AA} - C:\WINDOWS\System32\opacao.dll O18 - Filter: text/plain - {7A0BD340-051A-42BB-80C3-9E5F0CD864AA} - C:\WINDOWS\System32\opacao.dll O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe |
1.escan -lade dir escan runter und gehe genau nach dieser anleitung vor 2.einträge löschen -fixe mit hijackthis diese einträge: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\thorsten\LOKALE~1\Temp\sp.dll/sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOKUME~1\thorsten\LOKALE~1\Temp\sp.dll/sp.html O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll (file missing) O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} - C:\Programme\NavExcel\NavHelper\v2.0.4d\NHelper.dl l O2 - BHO: (no name) - {E7E199D8-A419-4775-BD55-BF2F38FA5E44} - C:\WINDOWS\System32\opacao.dll O4 - HKLM\..\Run: [navapp] C:\Programme\NavExcel\NavHelper\v2.0.4d\navapp.exe O4 - HKLM\..\Run: [CMESys] "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe" O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - Global Startup: GStartup.lnk = C:\Programme\Gemeinsame Dateien\GMT\GMT.exe O8 - Extra context menu item: Ebates - file://C:\Programme\Ebates_MoeMoneyMaker\Sy350\Tp350\scri 350a.htm O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Programme\Ebates_MoeMoneyMaker\Sy350\Tp350\scri 350a.htm (file missing) (HKCU) O9 - Extra button: Ebates - {7F241C00-DAB6-11d5-AAA8-0001028DF1BC} - file://C:\Programme\EbatesMoeMoneyMaker\System\Temp\ebate s_script0.htm (file missing) (HKCU) O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/0766c75c74f698...RdxIE601_de.cab O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} (AcontiX Control) - http://secure.aconti.net/acontix/acontix.cab O18 - Filter: text/html - {7A0BD340-051A-42BB-80C3-9E5F0CD864AA} - C:\WINDOWS\System32\opacao.dll O18 - Filter: text/plain - {7A0BD340-051A-42BB-80C3-9E5F0CD864AA} - C:\WINDOWS\System32\opacao.dll 3.dateien löschen -lösche die datei opacao.dll im ordner C:\WINDOWS\System32 -lösche den ordner C:\WINDOWS\System32\P2P Networking -lösche den ordner C:\Programme\Gemeinsame Dateien\CMEII\ -lösche den ordner C:\Programme\MyWay\ -lösche den ordner C:\Programme\Gemeinsame Dateien\GMT\ -lösche natürlich auch alle von escan beanstandeten dateien (alle infected) (falls die dateien nicht angezeigt werden gehe so vor: klicke auf extras, dann auf ordneroptionen klicke auf ansicht mach den haken bei "geschützte systemdateien ausblenden" weg mach nen haken bei "inhalte von systemordnern anzeigen" hin selektiere "alle dateien und ordner anzeigen") 4.ergebnisse -gehe wieder in den normalen modus -öffne die datei mwav.log,klicke auf bearbeiten dann auf suchen -gebe infected ein -suche weiter,markiere die treffer und kopiere sie ins forum -poste ein neues hijackthis log |
ok, hier das kopierte aus mwav.log.. is ziemlich viel, aber ich glaub ich sollte das so machen oder? achja und all das zeug bei system volume information, was zwar angezeigt wurde, bei escan, konnt ich net löschen. Ich hatte zwar im abgesicherten Modus windows gestartet und auch die Häkchen so gesetzt, wie in der anleitung, aber als ich in den ornder rein wollte, stand da, dass der zugriff verweigert sei. File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\GCONTR~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\Gtools.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GIocl.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GStore.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\CMEIIAPI.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GIOCLC~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\GSTORE~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gdwldeng.dll infected by "not-a-virus:AdWare.Gator.3124" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gmtproxy.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gappmgr.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GObjs.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\GMT.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGNSEN~1.DLL infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGIEPR~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGGCEN~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\GatorRes.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\CD_Clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGIEEN~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\opacao.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Priggle[pgg-10240,de,5c9286a2d7a45c1d907a7987ca0d606e].exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\CD_CLINT.DLL infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\Temp\cd_clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\Temp\remove.exe infected by "TrojanDownloader.Win32.Keenval.f" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\Temp\sp.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\Temp\__unin__.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\TEMPOR~1\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[1].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\TEMPOR~1\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[2].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\TEMPOR~1\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[3].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\TEMPOR~1\Content.IE5\2LL6J69S\on-line[1].exe infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\thorsten\LOKALE~1\TEMPOR~1\Content.IE5\K5W3OJCV\sum41_doesthislookinfected[1].htm File C:\Programme\MyWay\myBar\2.bin\MYBAR.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\opacao.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Priggle[pgg-10240,de,5c9286a2d7a45c1d907a7987ca0d606e].exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\CD_CLINT.DLL infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Desktop\backups\backup-20050128-172834-798.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Eigene Dateien\Programme\dvdrnb5001.exe infected by "not-a-virus:AdWare.NavExcel" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Eigene Dateien\Programme\fgf150.exe infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Eigene Dateien\Programme\Internet\download_serial.exe infected by "TrojanDownloader.Win32.Swizzor.i" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temp\cd_clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temp\remove.exe infected by "TrojanDownloader.Win32.Keenval.f" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temp\sp.dll infected by "not-a-virus:AdWare.SearchPage" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temp\__unin__.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[1].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[2].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2LL6J69S\LEEydn8kSTefLOCCoscH[3].chm infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2LL6J69S\on-line[1].exe infected by "Trojan-Downloader.Win32.Agent.hr" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\K5W3OJCV\sum41_doesthislookinfected[1].htm File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\TK0ZWB6G\seppelseum.de[2] infected by "Worm.Firkin.b" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\thorsten\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YJY3M56F\P2P(6-p2p-1-0-#0)[1].exe infected by "not-a-virus:Porn-Dialer.Win32.ALifeDialer" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\adm4005.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\asmps.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Points Manager\sysdetect.dll infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. |
C:\Programme\AVPersonal\INFECTED\*.* File C:\Programme\FlashGet\BACKUP\cd_install277.exe infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\CMEIIAPI.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GAppMgr.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GController.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GDwldEng.dll infected by "not-a-virus:AdWare.Gator.3124" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GIocl.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GIoclClient.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GMTProxy.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GObjs.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GStore.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GStoreServer.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\Gtools.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGGCEngine.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\egIEEngine.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGIEProcess.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGNSEngine.dll infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GatorRes.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GatorStubSetup.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GMT.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\gtrawbm.fil infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GUninstaller.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\phlcannb\bnnlddep\cllppdae.exe infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\phlcannb\pnrlfljdcj\pelbpccrj.exe infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\Kazaa\TopSearch.dll infected by "not-a-virus:AdWare.Altnet.d" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\2.bin\MY2NS.EXE infected by "not-a-virus:AdWare.Toolbar.MyWay.b" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\2.bin\NPMYWAY.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.f" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047444.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047445.dll infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047446.dll infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047448.dll infected by "not-a-virus:AdWare.Gator.5017" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047451.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047453.dll infected by "not-a-virus:AdWare.Gator.3124" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047454.dll infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047455.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047456.exe infected by "not-a-virus:AdWare.Gator.4203" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047457.dll infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047459.dll infected by "not-a-virus:AdWare.Gator.6051" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP29\A0047462.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054534.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054535.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054536.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054537.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054538.exe infected by "not-a-virus:Porn-Dialer.Win32.Intexdial" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054539.DLL infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{B56689C8-B315-4E42-B11C-764743577990}\RP30\A0054540.dll infected by "Trojan.Win32.StartPage.ix" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\Setup.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. |
und hier noch das 2. Hijackthis log.. Logfile of HijackThis v1.99.0 Scan saved at 11:20:56, on 29.01.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\RunDll32.exe C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\Programme\QuickTime\qttask.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~2\Altnet\DOWNLO~1\asm.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Microsoft Office\Office\WINWORD.EXE C:\Dokumente und Einstellungen\thorsten\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Mirabilis ICQ] C:\Programme\ICQ\NDetect.exe O4 - HKLM\..\Run: [KAZAA] C:\Programme\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Programme\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe" O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://C:\Programme\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Alles mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: Backward &Links - res://C:\Programme\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Programme\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Mit FlashGet laden - C:\PROGRA~1\FlashGet\jc_link.htm O8 - Extra context menu item: Si&milar Pages - res://C:\Programme\Google\GoogleToolbar1.dll/cmsimilar.html O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\ICQ.exe O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti...l_v1-0-3-9.cab O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 14:47 Uhr. |
Copyright ©2000-2025, Trojaner-Board