|
Hilfe!!! agent.bq - agent.bi Brauche Hilfe. AntiVir meldet 2 Trojaner auf meinem Rechner - agent.bq -agent.bi. Werde die Dinger trotz mehrfachen Löschens einfach nicht los. Die Meldungen erscheinen, sobald ich im Internet-Explorer eine URL eingebe. Weiterhin erscheinen Pop-Ups mit Werbung. Habe mittlerweile Hijack This V1.99 installiert und folgenden Log (Win 98 im nicht abgesicherten Modus) erhalten: Logfile of HijackThis v1.99.1 Scan saved at 21:37:44, on 23.05.05 Platform: Windows 98 Gold (Win9x 4.10.1998) MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800) Running processes: C:\WINDOWS.000\SYSTEM\KERNEL32.DLL C:\WINDOWS.000\SYSTEM\MSGSRV32.EXE C:\WINDOWS.000\SYSTEM\MPREXE.EXE C:\WINDOWS.000\SYSTEM\MSTASK.EXE C:\WINDOWS.000\EXPLORER.EXE C:\WINDOWS.000\SYSTEM\SYSTRAY.EXE C:\WINDOWS.000\ELSAUTIL\WINMSUIT.EXE C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE C:\WINDOWS.000\LOADQM.EXE C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\DE\MSNAPPAU.EXE C:\WINDOWS.000\SYSTEM\DDHELP.EXE C:\WINDOWS.000\SYSTEM\SPOOL32.EXE C:\WINDOWS.000\SYSTEM\RNAAPP.EXE C:\WINDOWS.000\SYSTEM\TAPISRV.EXE C:\WINDOWS.000\SYSTEM\PSTORES.EXE C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS.000\RUNDLL32.EXE C:\TEMP\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS.000\system\mjlrk.dll/sp.html#37049 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von T-Online R3 - Default URLSearchHook is missing O2 - BHO: Class - {0AA3E97C-CC09-0A1A-0EE2-40E184B01F82} - C:\WINDOWS.000\SYSTEM\D3AL32.DLL O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\SYSTEM\MSDXM.OCX O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.4000.1001\DE\MSNTB.DLL (file missing) O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe O4 - HKLM\..\Run: [AtiKey] Atitask.exe O4 - HKLM\..\Run: [ELSA WINman Suite] C:\WINDOWS.000\ELSAUTIL\WINMSUIT.EXE /startup O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE" O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE /min O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\de\msnappau.exe" O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE O4 - HKLM\..\Run: [JAVAIW32.EXE] C:\WINDOWS.000\SYSTEM\JAVAIW32.EXE O4 - HKLM\..\Run: [JAVANJ32.EXE] C:\WINDOWS.000\SYSTEM\JAVANJ32.EXE O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [MFCLQ.EXE] C:\WINDOWS.000\SYSTEM\MFCLQ.EXE /s O4 - HKLM\..\RunServices: [WINUC.EXE] C:\WINDOWS.000\SYSTEM\WINUC.EXE /s O4 - HKLM\..\RunServices: [APPSE.EXE] C:\WINDOWS.000\SYSTEM\APPSE.EXE /s O4 - HKLM\..\RunServices: [JAVALM32.EXE] C:\WINDOWS.000\JAVALM32.EXE /s O4 - HKLM\..\RunServices: [MSXN.EXE] C:\WINDOWS.000\SYSTEM\MSXN.EXE /s O4 - HKLM\..\RunServices: [WINJJ32.EXE] C:\WINDOWS.000\WINJJ32.EXE /s O4 - HKLM\..\RunServices: [NTQY32.EXE] C:\WINDOWS.000\NTQY32.EXE /s O4 - HKLM\..\RunServices: [SDKRK.EXE] C:\WINDOWS.000\SYSTEM\SDKRK.EXE /s O4 - HKLM\..\RunServices: [NTJU32.EXE] C:\WINDOWS.000\SYSTEM\NTJU32.EXE /s O4 - HKLM\..\RunServices: [SYSBS.EXE] C:\WINDOWS.000\SYSBS.EXE /s O4 - HKLM\..\RunServices: [CROD32.EXE] C:\WINDOWS.000\SYSTEM\CROD32.EXE /s O4 - HKLM\..\RunServices: [MFCZQ32.EXE] C:\WINDOWS.000\SYSTEM\MFCZQ32.EXE /s O4 - HKLM\..\RunServices: [APPNZ32.EXE] C:\WINDOWS.000\SYSTEM\APPNZ32.EXE /s O4 - HKLM\..\RunServices: [NTFW.EXE] C:\WINDOWS.000\NTFW.EXE /s O4 - HKLM\..\RunServices: [JAVAXE.EXE] C:\WINDOWS.000\JAVAXE.EXE /s O4 - HKLM\..\RunServices: [ADDBL.EXE] C:\WINDOWS.000\SYSTEM\ADDBL.EXE /s O4 - HKLM\..\RunServices: [ADDBW.EXE] C:\WINDOWS.000\ADDBW.EXE /s O4 - HKLM\..\RunServices: [SDKVH.EXE] C:\WINDOWS.000\SDKVH.EXE /s O4 - HKLM\..\RunServices: [JAVAHH32.EXE] C:\WINDOWS.000\JAVAHH32.EXE /s O4 - HKLM\..\RunServices: [WINHC32.EXE] C:\WINDOWS.000\WINHC32.EXE /s O4 - HKLM\..\RunServices: [IEDT.EXE] C:\WINDOWS.000\SYSTEM\IEDT.EXE /s O4 - HKLM\..\RunServices: [NTBD32.EXE] C:\WINDOWS.000\SYSTEM\NTBD32.EXE /s O4 - HKLM\..\RunServices: [APIEB32.EXE] C:\WINDOWS.000\SYSTEM\APIEB32.EXE /s O4 - HKLM\..\RunServices: [JAVAOB.EXE] C:\WINDOWS.000\JAVAOB.EXE /s O4 - HKLM\..\RunServices: [NTFI32.EXE] C:\WINDOWS.000\SYSTEM\NTFI32.EXE /s O4 - HKLM\..\RunServices: [NTLK.EXE] C:\WINDOWS.000\NTLK.EXE /s O4 - HKLM\..\RunServices: [NTZZ32.EXE] C:\WINDOWS.000\NTZZ32.EXE /s O4 - HKLM\..\RunServices: [ADDXV32.EXE] C:\WINDOWS.000\ADDXV32.EXE /s O4 - HKLM\..\RunServices: [CRPK32.EXE] C:\WINDOWS.000\CRPK32.EXE /s O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS.000\web\related.htm O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Programme\IrfanView\Ebay\Ebay.htm O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll O14 - IERESET.INF: START_PAGE_URL=http://www.t-online.de O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab Wäre nett, wenn mir jemand beim weiteren Vorgehen helfen könnte!! |
Hy, mach mal einen Escan nach Anleitung. Prog und Anleitung hier: www.trojaner-board.de/showthread.php?t=17492 Lass ihn im abgesicherten Modus durchlaufen poste das Ergebniss hier. Greetings from MEERJUNGFRAUMANN (SPONGEBOB MEMBER) :teufel3: |
Hallo Meerjungfraumann! Zunächst vielen Dank für Deine Antwort. Hatte die letzten zwei Tage die Schnauze voll von diesem Sch..., daher kommt der Log etwas verspätet - sorry. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ---------- c:\bases_x\mwav.log Tue May 24 18:43:20 2005 => File C:\WINDOWS.000\SYSTEM\D3AL32.DLL infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:43:36 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken. Tue May 24 18:44:39 2005 => File C:\WINDOWS.000\ntac.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:40 2005 => File C:\WINDOWS.000\yqdnma.dat infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:41 2005 => File C:\WINDOWS.000\ztnjzh.dat infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:42 2005 => File C:\WINDOWS.000\mfccu.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:43 2005 => File C:\WINDOWS.000\msxj32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:44 2005 => File C:\WINDOWS.000\atlbt.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:45 2005 => File C:\WINDOWS.000\appvr32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:46 2005 => File C:\WINDOWS.000\apity32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:47 2005 => File C:\WINDOWS.000\javass32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:47 2005 => File C:\WINDOWS.000\javayg.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:48 2005 => File C:\WINDOWS.000\crbv.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:49 2005 => File C:\WINDOWS.000\winfp32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:50 2005 => File C:\WINDOWS.000\iedi.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:51 2005 => File C:\WINDOWS.000\mfcrs32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:52 2005 => File C:\WINDOWS.000\appqd.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:53 2005 => File C:\WINDOWS.000\ipep.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:54 2005 => File C:\WINDOWS.000\crkw.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:55 2005 => File C:\WINDOWS.000\iezb.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:56 2005 => File C:\WINDOWS.000\mscv32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:44:57 2005 => File C:\WINDOWS.000\ipxk32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:29 2005 => File C:\WINDOWS.000\SYSTEM\addyu.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:31 2005 => File C:\WINDOWS.000\SYSTEM\systs32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:32 2005 => File C:\WINDOWS.000\SYSTEM\d3tz.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:32 2005 => File C:\WINDOWS.000\SYSTEM\winlk.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:33 2005 => File C:\WINDOWS.000\SYSTEM\mslt.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:34 2005 => File C:\WINDOWS.000\SYSTEM\msgq.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:35 2005 => File C:\WINDOWS.000\SYSTEM\mfckf32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:36 2005 => File C:\WINDOWS.000\SYSTEM\apiuf.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:37 2005 => File C:\WINDOWS.000\SYSTEM\netiz32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:39 2005 => File C:\WINDOWS.000\SYSTEM\ntfi32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:40 2005 => File C:\WINDOWS.000\SYSTEM\sysnx.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:41 2005 => File C:\WINDOWS.000\SYSTEM\mfcid.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:42 2005 => File C:\WINDOWS.000\SYSTEM\mspl.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:43 2005 => File C:\WINDOWS.000\SYSTEM\ipgn32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:44 2005 => File C:\WINDOWS.000\SYSTEM\appxb.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:45 2005 => File C:\WINDOWS.000\SYSTEM\ntxx32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:46 2005 => File C:\WINDOWS.000\SYSTEM\ntak.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:47 2005 => File C:\WINDOWS.000\SYSTEM\apprm32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 18:47:47 2005 => File C:\WINDOWS.000\SYSTEM\crdf32.dll infected by "Trojan-Downloader.Win32.Agent.bc" Virus! Action Taken: No Action Taken. Tue May 24 19:11:26 2005 => Total Disinfected Files: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ---------- c:\bases_x\mwav.log Tue May 24 18:54:24 2005 => File C:\WINDOWS\TWAIN_32\stdsc\unreg.exe tagged as not-a-virus:Tool.WinCap.Reboot. No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ---------- c:\bases_X\mwav.log Tue May 24 19:11:26 2005 => Total Virus(es) Found: 46 ---------- c:\bases_x\mwav.log Tue May 24 19:11:26 2005 => Total Errors: 4 ---------- c:\bases_x\mwav.log Tue May 24 19:11:26 2005 => Time Elapsed: 00:27:14 ---------- c:\bases_x\mwav.log Tue May 24 19:11:26 2005 => Total Objects Scanned: 13252 ---------- c:\bases_x\mwav.log Tue May 24 18:42:44 2005 => Virus Database Date: 2005/05/24 Tue May 24 19:11:27 2005 => Virus Database Date: 2005/05/24 Tue May 24 19:11:56 2005 => Virus Database Date: 2005/05/24 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ Eine wichtige Frage: Ist es noch zu vertreten, von diesem Rechner aus Online-Banking zu machen, oder sollte ich wieder Überweisungsformulare ausfüllen? Gruß Busch |
@Busch Zitat:
Zitat:
|
http://www.sophos.de/virusinfo/analy...ojiefeatr.html Hier ist es beschrieben. Ich würde, obwohl der Virus keine Backdoor-Funktion besitzt, für eine Neuinstalation plädieren. Sicherlich kann man ihn wegbekommen. Was mir an dem System nicht gefällt: Du hast schon mal drüberinstalliert. Du kannst aber auch versuchen, Antivir im abgeicherten Modus laufen zu lassen. Da der Virus schon älter ist, sollte das Programm, wenn es geupdatet ist, zum Löschen in der Lage sein. Edit by Felix: @Rene-gad Sch..., wieder mal für den Papierkorb gearbeitet :daumenhoc |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 11:17 Uhr. |
Copyright ©2000-2025, Trojaner-Board