Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   HILFE - Downloader.BSU (https://www.trojaner-board.de/17057-hilfe-downloader-bsu.html)

Tha Marquis 25.04.2005 17:30
HILFE - Downloader.BSU
 
Hallo zusammen,

bitte bitte helft mir mit der SCH...E! Seit letzter Woche habe ich wohl einen Trojaner/Hijacker in meiner Kiste...

Immer wenn ich den IE starte, hab ich als Startseite "About:blank" und in meinen Fav's sind "sehr merkwürdige" sites :koch:

Habe Panda bei mir als Antivirus-prog installiert - als Meldung wird mir dann immer angezeigt:

"Ein Virus wurde entdeckt und die Datei wurde desinfiziert: Trj.Downloader.BSU; Virenstandort: C:\Windows\iexx.exe" (anstatt iexx.exe stand gestern was anderes)

als weitere Meldung kommt noch die Erkennung von diversen Adwares, die aber angeblich gelöscht wurden... Wenn ich dann aber wieder den IE starte, sind sie wieder da - zumindest die Meldung von Panda

Hatte so nen Mist schonmal, da habe ich aber alles mit Hilfe von HJT wieder hinbekommen, aber als ich es diesemal mit der aktuellen Version versucht habe, ging es nicht.. Hier mal meine log:


Logfile of HijackThis v1.99.1
Scan saved at 18:14:32, on 25.04.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)



R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {C5E8D939-2CE8-9ADD-8CA0-BD0FC64AA090} - C:\WINDOWS\system32\syskw32.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programme\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccRegVfy] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Programme\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\GEMEIN~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CursorXP] C:\Programme\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Programme\FreeRAM\FreeRAM.exe
O4 - HKCU\..\Run: [BlockAds] "C:\Programme\Tweak-XP Pro 4\AdBlocker.exe"
O4 - Startup: Reboot.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: AOL 8.0 Tray-Symbol.lnk = C:\Programme\AOL 8.0\aoltray.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\Klemens\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing)
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programme\AIM95\aim.exe (file missing)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\Klemens\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{73C98BC0-4D46-4E1D-92AB-88F12DA607EA}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF36180F-587A-4753-96D5-49FAEBDE52AF}: NameServer = 192.168.1.1
O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~2\WINDOW~1\fastload.dll
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Irgendwie hab ich das Gefühl, dass sich die Pfade, die ich lt. Übersetzung von HJT fixen soll, immer ändern (gestern war es R01....\WINDOWS\nmjfb.dll\...)


Ich wäre euch sehr, sehr dankbar, wenn ihr mir hier weiterhelfen könntet!!!

Schönen gruß,
KR

cacatoa 26.04.2005 08:00
Hi,
erst mal solltest Du dir den folgenden thread genau durchlesen:-->
DAS ist nämlich eins Deiner Probleme.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345

Desweiteren ist es sinnvoll, ein komplettes HJT-Logfile zu posten und nicht nur einen Auszug.
cacatoa

Tha Marquis 26.04.2005 17:34
Hallo,

habe mir den thread durchgelesen, escan u. das Prog von Seeker runtergeladen. Habe escan, SPSeHjFix und HJT im abgesicherten Modus durchlaufen lassen...

Hier die HJT-Log:

Logfile of HijackThis v1.99.1
Scan saved at 17:55:10, on 26.04.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {C5E8D939-2CE8-9ADD-8CA0-BD0FC64AA090} - C:\WINDOWS\system32\syskw32.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programme\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccRegVfy] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Programme\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CreateCD50] C:\PROGRA~1\GEMEIN~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Programme\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CursorXP] C:\Programme\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Programme\FreeRAM\FreeRAM.exe
O4 - HKCU\..\Run: [BlockAds] "C:\Programme\Tweak-XP Pro 4\AdBlocker.exe"
O4 - Startup: Reboot.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: AOL 8.0 Tray-Symbol.lnk = C:\Programme\AOL 8.0\aoltray.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing)
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programme\AIM95\aim.exe (file missing)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF36180F-587A-4753-96D5-49FAEBDE52AF}: NameServer = 192.168.1.1
O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~2\WINDOW~1\fastload.dll
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


Hier die Log von SPSeHjFix:

(26.4.05 17:12:22) SPSeHjFix started v1.1.2
(26.4.05 17:12:22) OS: WinXP Service Pack 2 (5.1.2600)
(26.4.05 17:12:22) Language: deutsch
(26.4.05 17:12:22) Win-Path: C:\WINDOWS
(26.4.05 17:12:22) System-Path: C:\WINDOWS\system32
(26.4.05 17:12:22) Temp-Path: C:\DOKUME~1\...\LOKALE~1\Temp\
(26.4.05 17:12:30) Disinfection started
(26.4.05 17:12:30) Bad-Dll(IEP): (not found)
(26.4.05 17:12:30) Bad-Dll(IEP) in BHO: (not found)
(26.4.05 17:12:30) UBF: 4 - UBB: 1 - UBR: 23
(26.4.05 17:12:30) UBF: 4 - UBB: 1 - UBR: 23
(26.4.05 17:12:30) Bad IE-pages: (none)
(26.4.05 17:12:30) Stealth-String not found
(26.4.05 17:12:30) Not infected->END


und zum SChluß noch die Log vom E-Scan:

Tue Apr 26 17:58:52 2005 => **********************************************************
Tue Apr 26 17:58:52 2005 => MicroWorld AntiVirus Toolkit Utility.
Tue Apr 26 17:58:52 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc.
Tue Apr 26 17:58:52 2005 => **********************************************************
Tue Apr 26 17:58:52 2005 => Version 6.1.1 (C:\Dokumente und Einstellungen\...\Eigene Dateien\Programme\Escan\mwavscan.com)
Tue Apr 26 17:58:52 2005 => Log File: C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\MWAV.LOG
Tue Apr 26 17:58:52 2005 => Last Scan Date and Time: 26.04.2005 17:44:21
Tue Apr 26 17:58:52 2005 => MWAV Registered: FALSE.
Tue Apr 26 17:58:52 2005 => MWAV Mode: Only Scan files.
Tue Apr 26 17:58:52 2005 => Latest Date of files inside MWAV: 25 Apr 2005 09:31:39.
Tue Apr 26 17:58:55 2005 => AV Library Loaded...
Tue Apr 26 17:58:55 2005 => MWAV doing self scanning...
Tue Apr 26 17:58:55 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\kavss.exe
Tue Apr 26 17:58:55 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\Getvlist.exe
Tue Apr 26 17:58:55 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\kavss.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\kavssdi.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\kavssi.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\kavvlg.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\msvlclnt.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\ipc.dll
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\main.avi
Tue Apr 26 17:58:56 2005 => Scanning File C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\virus.avi
Tue Apr 26 17:58:56 2005 => MWAV files are clean.
Tue Apr 26 17:59:00 2005 => Virus Database Date: 2005/04/25
Tue Apr 26 17:59:00 2005 => Virus Database Count: 127328

Tue Apr 26 17:59:09 2005 => **********************************************************
Tue Apr 26 17:59:09 2005 => MicroWorld AntiVirus Toolkit Utility.
Tue Apr 26 17:59:09 2005 => Copyright © 2003-2005, MicroWorld Technologies Inc.
Tue Apr 26 17:59:09 2005 =>
Tue Apr 26 17:59:09 2005 => Support: support@mwti.net
Tue Apr 26 17:59:09 2005 => Web: http://www.mwti.net
Tue Apr 26 17:59:09 2005 => **********************************************************
Tue Apr 26 17:59:09 2005 => Version 6.1.1 (C:\Dokumente und Einstellungen\...\Eigene Dateien\Programme\Escan\mwavscan.com)
Tue Apr 26 17:59:09 2005 => Log File: C:\DOKUME~1\...\EIGENE~1\PROGRA~1\Escan\MWAV.LOG
Tue Apr 26 17:59:09 2005 => User Account:
Tue Apr 26 17:59:09 2005 => Windows Root Folder: C:\WINDOWS
Tue Apr 26 17:59:09 2005 => Windows Sys32 Folder: C:\WINDOWS\system32
Tue Apr 26 17:59:09 2005 => OS: Windows NT
Tue Apr 26 17:59:09 2005 => Latest Date of files inside MWAV: 25 Apr 2005 09:31:39.

Tue Apr 26 17:59:09 2005 => Options Selected by User:
Tue Apr 26 17:59:09 2005 => Memory Check: Enabled
Tue Apr 26 17:59:09 2005 => Registry Check: Enabled
Tue Apr 26 17:59:09 2005 => StartUp Folder Check: Enabled
Tue Apr 26 17:59:09 2005 => System Folder Check: Enabled
Tue Apr 26 17:59:09 2005 => System Area Check: Disabled
Tue Apr 26 17:59:09 2005 => Services Check: Enabled
Tue Apr 26 17:59:09 2005 => Drive Check Option Disabled
Tue Apr 26 17:59:09 2005 => Folder Check: Disabled

Tue Apr 26 17:59:09 2005 => ***** Scanning Memory Files *****
Tue Apr 26 17:59:09 2005 => Scanning File C:\WINDOWS\System32\smss.exe
Tue Apr 26 17:59:09 2005 => Scanning File C:\WINDOWS\system32\ntdll.dll
Tue Apr 26 17:59:09 2005 => Scanning File C:\WINDOWS\SYSTEM32\CSRSS.EXE
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\CSRSRV.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\basesrv.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\winsrv.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\USER32.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\KERNEL32.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\GDI32.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\sxs.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\ADVAPI32.dll
Tue Apr 26 17:59:10 2005 => Scanning File C:\WINDOWS\system32\RPCRT4.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\SYSTEM32\WINLOGON.EXE
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\AUTHZ.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\msvcrt.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\CRYPT32.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\MSASN1.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\NDdeApi.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\PROFMAP.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\NETAPI32.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\USERENV.dll
Tue Apr 26 17:59:11 2005 => Scanning File C:\WINDOWS\system32\PSAPI.DLL
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\REGAPI.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\Secur32.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\SETUPAPI.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\VERSION.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\WINSTA.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\WINTRUST.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\IMAGEHLP.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\WS2_32.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\WS2HELP.dll
Tue Apr 26 17:59:12 2005 => Scanning File C:\WINDOWS\system32\MSGINA.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\SHELL32.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\SHLWAPI.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\COMCTL32.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\ODBC32.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\comdlg32.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\odbcint.dll
Tue Apr 26 17:59:13 2005 => Scanning File C:\WINDOWS\system32\SHSVCS.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\sfc.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\sfc_os.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\ole32.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\Apphelp.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\WINMM.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\serwvdrv.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\umdmxfrm.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\cscdll.dll
Tue Apr 26 17:59:14 2005 => Scanning File C:\WINDOWS\system32\WlNotify.dll
Tue Apr 26 17:59:15 2005 => Scanning File C:\WINDOWS\system32\WinSCard.dll
Tue Apr 26 17:59:15 2005 => Scanning File C:\WINDOWS\system32\WTSAPI32.dll
Tue Apr 26 17:59:15 2005 => Scanning File C:\WINDOWS\system32\WINSPOOL.DRV


Also ich weiß jetzt nicht so recht wie ich weitermachen soll, da mir das SPSeHjFix ja "not infected" als Ergebnis geliefert hat... Hatte irgendwie gehofft, das Prog würde die Viren finden können.

Daher wäre ich für jeden Tip dankbar!!!

Schönen Gruß und besten Dank im Voraus,
KR

Cidre 26.04.2005 17:46
Hallo Tha Marquis,

poste nochmal die genaue Virus Log Information und zwar so:

Rechtsklick auf die Find.bat -> Ziel speichern unter… z.B. 'C:\Find.bat' -> Find.bat doppelklicken und den Scan abwarten -> den Inhalt [1] der automatisch erstellten C:\eScan_neu.txt hier posten [1].
[1] Strg+A (alles markieren) -> Strg+C (kopieren) -> Strg+V (hier in den Thread einfügen).

Erstelle ebenfalls ein aktuelles HJT Log-File aus dem 'normalen Modus' und poste es.

Tha Marquis 27.04.2005 16:07
Hallo Cidre,

habe versucht nach deiner anleitung vorzugehen:

1. Find.bat gespeichert und Doppelklick
2. Verzweifelt die Log gesucht, aber net gefunden (scheint so, als würde bei mir einfach keine log erstellt - habe es bestimmt 20 mal probiert und mir immer nen wolf gesucht)

daher kann ich leider die gewünschte log nich posten... Gibt es hier noch eine andere Möglichkeit, wie ich die genaue Virus Lo Information posten kann??

hier meine aktuelle HJT-Log:

Logfile of HijackThis v1.99.1
Scan saved at 16:52:35, on 27.04.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Stardock\Object Desktop\WindowBlinds\wbload.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Winamp\winampa.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fpdisp4.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\CloneCD\CloneCDTray.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE
C:\Programme\Messenger\msmsgs.exe
C:\Programme\CursorXP\CursorXP.exe
C:\Programme\FreeRAM\FreeRAM.exe
C:\Programme\Tweak-XP Pro 4\AdBlocker.exe
C:\Programme\AOL 8.0\aoltray.exe
C:\Programme\Sitecom\Bluetooth Software\BTTray.exe
C:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\SRVLOAD.EXE
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\AVENGINE.EXE
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\alg.exe
C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\WebProxy.exe
C:\Programme\AOL 8.0\waol.exe
C:\Programme\AOL 8.0\shellmon.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vimre.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vimre.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {C5E8D939-2CE8-9ADD-8CA0-BD0FC64AA090} - C:\WINDOWS\system32\syskw32.dll
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [FinePrint Dispatcher v4] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\fpdisp4.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Programme\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SCANINICIO] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PasSrv.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CursorXP] C:\Programme\CursorXP\CursorXP.exe
O4 - HKCU\..\Run: [BySoft FreeRAM] C:\Programme\FreeRAM\FreeRAM.exe
O4 - HKCU\..\Run: [BlockAds] "C:\Programme\Tweak-XP Pro 4\AdBlocker.exe"
O4 - Startup: Reboot.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: AOL 8.0 Tray-Symbol.lnk = C:\Programme\AOL 8.0\aoltray.exe
O4 - Global Startup: BTTray.lnk = ?
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing)
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Programme\AIM95\aim.exe (file missing)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - C:\Dokumente und Einstellungen\...\Lokale Einstellungen\Temporary Internet Files\Content.IE5\S269P272\access[3].exe (file missing) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\..\{73C98BC0-4D46-4E1D-92AB-88F12DA607EA}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF36180F-587A-4753-96D5-49FAEBDE52AF}: NameServer = 192.168.1.1
O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~2\WINDOW~1\fastload.dll
O23 - Service: Bluetooth Service (btwdins) - Unknown owner - C:\Programme\Sitecom\Bluetooth Software\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PaSSrv.exe
O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Firewall\PavFires.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavFnSvr.exe
O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\Pavkre.exe
O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PavProt.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\pavsrv51.exe
O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\prevsrv.exe
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Programme\Panda Software\Panda Platinum 2005 Internet Security\PsImSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Hast/habt du/ihr noch nen Vorschlag?!?!?!?!?! :heulen:

LG,
KR

Cidre 27.04.2005 19:13
Komisch, es existiert auch keine 'C:\eScan_neu.txt'?

Ansonsten musst du leider den beschwerlichen Weg gehen:
Öffne die mwav.log im Ordner C:\bases_x -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen.

Haui45 27.04.2005 19:15
Es dürfte am Pfad liegen
Zitat:
C:\Dokumente und Einstellungen\...\Eigene Dateien\Programme\Escan\mwavscan.com

Cidre 27.04.2005 19:29
@ Haui45

Gut erkannt, ist mir gar nicht aufgefallen. :daumenhoc

Tha Marquis 27.04.2005 21:16
Guten Abend,

ähm, ich hab das problem mit dem pfad nich so ganz verstanden... Funktioniert das nur, wenn escan direkt auf C installiert ist!? Ich hatte heute nachmittag nämlich auch in dem escan ordner unter C:\Dokumente und Einstellungen\...\Eigene Dateien\Programme\Escan geschaut und da hat er ja auch keine file namens eScan_neu.txt angezeigt!?!?

Naja egal, auf jeden Fall sind jetzt hier die Ergebnisse, die mir durch das Suchen in der mwav.log angezeigt wurden:

Tue Apr 26 17:59:29 2005 => Scanning File C:\WINDOWS\system32\syskw32.dll
Tue Apr 26 17:59:40 2005 => File C:\WINDOWS\system32\syskw32.dll infected by "Trojan-Downloader.Win32.Agent.lz" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:00:00 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\sw !!!
Tue Apr 26 18:00:00 2005 => System found infected with sw Spyware/Adware! Action taken: No Action Taken.
Tue Apr 26 18:00:00 2005 => File System Found infected by "sw Spyware/Adware" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:00:00 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\se !!!
Tue Apr 26 18:00:00 2005 => System found infected with se Spyware/Adware! Action taken: No Action Taken.
Tue Apr 26 18:00:00 2005 => File System Found infected by "se Spyware/Adware" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:00:00 2005 => Offending value found in HKLM\Software\Microsoft\Windows\CurrentVersion\uninstall\hsa !!!
Tue Apr 26 18:00:00 2005 => System found infected with hsa Spyware/Adware! Action taken: No Action Taken.
Tue Apr 26 18:00:00 2005 => File System Found infected by "hsa Spyware/Adware" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:01:34 2005 => Scanning File C:\WINDOWS\system32\crtv2_32.dll
Tue Apr 26 18:01:34 2005 => File C:\WINDOWS\system32\crtv2_32.dll infected by "Trojan-Downloader.Win32.Small.ut" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:03:21 2005 => Scanning File C:\DOKUME~1\...\LOKALE~1\TEMPOR~1\Content.IE5\KNPRYYJ5\dia171[1].htm
Tue Apr 26 18:03:21 2005 => File C:\DOKUME~1\...\LOKALE~1\TEMPOR~1\Content.IE5\KNPRYYJ5\dia171[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.

Tue Apr 26 18:03:21 2005 => Scanning File C:\DOKUME~1\...\LOKALE~1\TEMPOR~1\Content.IE5\KNPRYYJ5\1085[1].htm
Tue Apr 26 18:03:21 2005 => File C:\DOKUME~1\...\LOKALE~1\TEMPOR~1\Content.IE5\KNPRYYJ5\1085[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken.


Ich hoffe ihr könnt damit etwas anfangen... :confused:

Aber auf jeden Fall schonmal besten Dank dafür, dass ihr hier vorbeischaut und helft!!!

Schönen Gruß,
KR

Tha Marquis 02.05.2005 06:14
Hallo,

könnte sich bitte einer nochmal meine logs (s.o.) anschauen... Ich weiß nich mehr weiter, und das Ding NERVT!!!

Habt besten Dank!
KR

Tha Marquis 02.05.2005 17:41
Hallo nochmal,

habe heute nochmal das tool SPSeHjFix versucht zu starten und siehe da... Das Problem bestand wohl darin, dass der Hintergrund destools hell-gelb ist und die schrift weiß... Habe wohl eher aus Zufall auf den Button gdrückt, so dass ich den editor komme.

Hier jetzt mal die Log von SPSeHjFix mit der bitte um weitere Anweisungen/Tips wie ich den Hijacker losbekomme:



(26.4.05 17:12:22) SPSeHjFix started v1.1.2
(26.4.05 17:12:22) OS: WinXP Service Pack 2 (5.1.2600)
(26.4.05 17:12:22) Language: deutsch
(26.4.05 17:12:22) Win-Path: C:\WINDOWS
(26.4.05 17:12:22) System-Path: C:\WINDOWS\system32
(26.4.05 17:12:22) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(26.4.05 17:12:30) Disinfection started
(26.4.05 17:12:30) Bad-Dll(IEP): (not found)
(26.4.05 17:12:30) Bad-Dll(IEP) in BHO: (not found)
(26.4.05 17:12:30) UBF: 4 - UBB: 1 - UBR: 23
(26.4.05 17:12:30) UBF: 4 - UBB: 1 - UBR: 23
(26.4.05 17:12:30) Bad IE-pages: (none)
(26.4.05 17:12:30) Stealth-String not found
(26.4.05 17:12:30) Not infected->END


(26.4.05 17:55:46) SPSeHjFix started v1.1.2
(26.4.05 17:55:46) OS: WinXP Service Pack 2 (5.1.2600)
(26.4.05 17:55:46) Language: deutsch
(26.4.05 17:55:46) Win-Path: C:\WINDOWS
(26.4.05 17:55:46) System-Path: C:\WINDOWS\system32
(26.4.05 17:55:46) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(26.4.05 17:55:48) Disinfection started
(26.4.05 17:55:48) Bad-Dll(IEP): c:\windows\vimre.dll
(26.4.05 17:55:48) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:48) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:48) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKCU\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Bar: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Search Page: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Page_URL: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Default_Search_URL: res://c:\windows\vimre.dll/sp.html#12345
deleted: HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant: res://c:\windows\vimre.dll/sp.html#12345
(26.4.05 17:55:48) Stealth-String not found
(26.4.05 17:55:48) No locked Files to delete. End without Reboot
(26.4.05 17:55:53) Disinfection started
(26.4.05 17:55:53) Bad-Dll(IEP): c:\windows\vimre.dll
(26.4.05 17:55:53) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:53) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:53) Bad IE-pages: (none)
(26.4.05 17:55:53) Stealth-String not found
(26.4.05 17:55:53) No locked Files to delete. End without Reboot
(26.4.05 17:55:59) Disinfection started
(26.4.05 17:55:59) Bad-Dll(IEP): c:\windows\vimre.dll
(26.4.05 17:55:59) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:59) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:55:59) Bad IE-pages: (none)
(26.4.05 17:55:59) Stealth-String not found
(26.4.05 17:55:59) No locked Files to delete. End without Reboot
(26.4.05 17:56:01) Disinfection started
(26.4.05 17:56:01) Bad-Dll(IEP): c:\windows\vimre.dll
(26.4.05 17:56:01) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:01) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:01) Bad IE-pages: (none)
(26.4.05 17:56:01) Stealth-String not found
(26.4.05 17:56:01) No locked Files to delete. End without Reboot


(26.4.05 17:56:03) SPSeHjFix started v1.1.2
(26.4.05 17:56:03) OS: WinXP Service Pack 2 (5.1.2600)
(26.4.05 17:56:03) Language: deutsch
(26.4.05 17:56:03) Win-Path: C:\WINDOWS
(26.4.05 17:56:03) System-Path: C:\WINDOWS\system32
(26.4.05 17:56:03) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(26.4.05 17:56:04) Disinfection started
(26.4.05 17:56:04) Bad-Dll(IEP): (not found)
(26.4.05 17:56:04) Bad-Dll(IEP) in BHO: (not found)
(26.4.05 17:56:04) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:04) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:04) Bad IE-pages: (none)
(26.4.05 17:56:04) Stealth-String not found
(26.4.05 17:56:04) Not infected->END


(26.4.05 17:56:10) SPSeHjFix started v1.1.2
(26.4.05 17:56:10) OS: WinXP Service Pack 2 (5.1.2600)
(26.4.05 17:56:10) Language: deutsch
(26.4.05 17:56:10) Win-Path: C:\WINDOWS
(26.4.05 17:56:10) System-Path: C:\WINDOWS\system32
(26.4.05 17:56:10) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(26.4.05 17:56:11) Disinfection started
(26.4.05 17:56:11) Bad-Dll(IEP): (not found)
(26.4.05 17:56:11) Bad-Dll(IEP) in BHO: (not found)
(26.4.05 17:56:11) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:11) UBF: 4 - UBB: 1 - UBR: 24
(26.4.05 17:56:11) Bad IE-pages: (none)
(26.4.05 17:56:11) Stealth-String not found
(26.4.05 17:56:11) Not infected->END


(2.5.05 18:25:36) SPSeHjFix started v1.1.2
(2.5.05 18:25:36) OS: WinXP Service Pack 2 (5.1.2600)
(2.5.05 18:25:36) Language: deutsch
(2.5.05 18:25:36) Win-Path: C:\WINDOWS
(2.5.05 18:25:36) System-Path: C:\WINDOWS\system32
(2.5.05 18:25:36) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(2.5.05 18:25:45) Disinfection started
(2.5.05 18:25:45) Bad-Dll(IEP): (not found)
(2.5.05 18:25:45) Bad-Dll(IEP) in BHO: (not found)
(2.5.05 18:25:45) UBF: 4 - UBB: 1 - UBR: 12
(2.5.05 18:25:45) UBF: 4 - UBB: 1 - UBR: 12
(2.5.05 18:25:45) Bad IE-pages:
deleted: HKCU\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
deleted: HKLM\Software\Microsoft\Internet Explorer\Main, Start Page: about:blank
(2.5.05 18:25:45) Stealth-String not found
(2.5.05 18:25:45) Not infected->END


(2.5.05 18:26:44) SPSeHjFix started v1.1.2
(2.5.05 18:26:44) OS: WinXP Service Pack 2 (5.1.2600)
(2.5.05 18:26:44) Language: deutsch
(2.5.05 18:26:44) Win-Path: C:\WINDOWS
(2.5.05 18:26:44) System-Path: C:\WINDOWS\system32
(2.5.05 18:26:44) Temp-Path: C:\DOKUME~1\Klemens\LOKALE~1\Temp\
(2.5.05 18:26:53) Disinfection started
(2.5.05 18:26:53) Bad-Dll(IEP): (not found)
(2.5.05 18:26:53) Bad-Dll(IEP) in BHO: (not found)
(2.5.05 18:26:53) UBF: 4 - UBB: 1 - UBR: 12
(2.5.05 18:26:53) UBF: 4 - UBB: 1 - UBR: 12
(2.5.05 18:26:53) Bad IE-pages: (none)
(2.5.05 18:26:53) Stealth-String not found
(2.5.05 18:26:53) Not infected->END


Wäre euch sehr dankbar, wenn ihr weiterhelfen könntet.
KR


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:41 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131