Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/Agent.BI, TR/Dldr.Agent.BQ, about:blank (https://www.trojaner-board.de/18421-tr-agent-bi-tr-dldr-agent-bq-about-blank.html)

alfred_nuesse 30.05.2005 20:04

TR/Agent.BI, TR/Dldr.Agent.BQ, about:blank
 
Hallo, bitte um Hilfe. Habe mir sehr wahrscheinlich Trojaner
eingefangen Agent.BI und Agent.BQ.
Zusätzlich öffnet sich mein InternetExplorer immer mit der
Startseite "about:blank".
Wie bekomme ich dies wieder in Ordnung.
Hier mein Hijackthis.log.....

Logfile of HijackThis v1.99.1
Scan saved at 21:47:50, on 30.05.05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 (5.50.4134.0600)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMME\SYMANTEC\NORTON GHOST 2003\GHOSTSTARTSERVICE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE
C:\PROGRAMME\SYMANTEC\NORTON GHOST 2003\GHOSTSTARTTRAYAPP.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMME\ICQLITE\ICQLITE.EXE
C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE
C:\PROGRAMME\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAMME\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMME\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\TOOLS\PRINTKEY\PRINTKEY.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\MSOP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAMME\T-DSL SPEEDMANAGER\TSMSVC.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\TOOLS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qkgsk.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMME\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {C994FCD3-D1A4-0910-353C-61E92FF7661A} - C:\WINDOWS\SYSTEM\APPUS.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [T-DSL SpeedMgr] "C:\PROGRAMME\T-DSL SPEEDMANAGER\SPEEDMGR.EXE"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Programme\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAMME\INTERNET EXPLORER\IEXPLORE.EXE
O4 - HKLM\..\Run: [JAVAHC.EXE] C:\WINDOWS\SYSTEM\JAVAHC.EXE
O4 - HKLM\..\Run: [Security iGuard] C:\Programme\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\PROGRAMME\AVPERSONAL\AVGCTRL.EXE /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [GhostStartService] C:\PROGRAMME\SYMANTEC\NORTON GHOST 2003\GHOSTSTARTSERVICE.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [APIPG32.EXE] C:\WINDOWS\APIPG32.EXE /s
O4 - HKLM\..\RunServices: [APISV32.EXE] C:\WINDOWS\SYSTEM\APISV32.EXE /s
O4 - HKLM\..\RunServices: [WINTM.EXE] C:\WINDOWS\WINTM.EXE /s
O4 - HKLM\..\RunServices: [SDKTU32.EXE] C:\WINDOWS\SDKTU32.EXE /s
O4 - HKLM\..\RunServices: [APIRP.EXE] C:\WINDOWS\SYSTEM\APIRP.EXE /s
O4 - HKLM\..\RunServices: [IENZ.EXE] C:\WINDOWS\IENZ.EXE /s
O4 - HKLM\..\RunServices: [CRQX32.EXE] C:\WINDOWS\SYSTEM\CRQX32.EXE /s
O4 - HKLM\..\RunServices: [IEII32.EXE] C:\WINDOWS\IEII32.EXE /s
O4 - HKLM\..\RunServices: [MFCIL32.EXE] C:\WINDOWS\MFCIL32.EXE /s
O4 - HKLM\..\RunServices: [NETUS.EXE] C:\WINDOWS\SYSTEM\NETUS.EXE /s
O4 - HKLM\..\RunServices: [ADDCK32.EXE] C:\WINDOWS\SYSTEM\ADDCK32.EXE /s
O4 - HKLM\..\RunServices: [ATLZQ32.EXE] C:\WINDOWS\ATLZQ32.EXE /s
O4 - HKLM\..\RunServices: [ATLZL32.EXE] C:\WINDOWS\ATLZL32.EXE /s
O4 - HKLM\..\RunServices: [ADDEW.EXE] C:\WINDOWS\SYSTEM\ADDEW.EXE /s
O4 - HKLM\..\RunServices: [SDKEE32.EXE] C:\WINDOWS\SDKEE32.EXE /s
O4 - HKLM\..\RunServices: [ATLGN.EXE] C:\WINDOWS\SYSTEM\ATLGN.EXE /s
O4 - HKLM\..\RunServices: [NETKT.EXE] C:\WINDOWS\SYSTEM\NETKT.EXE /s
O4 - HKLM\..\RunServices: [SYSLH.EXE] C:\WINDOWS\SYSLH.EXE /s
O4 - HKLM\..\RunServices: [APIEN32.EXE] C:\WINDOWS\APIEN32.EXE /s
O4 - HKLM\..\RunServices: [SDKWE.EXE] C:\WINDOWS\SYSTEM\SDKWE.EXE /s
O4 - HKLM\..\RunServices: [SYSKF32.EXE] C:\WINDOWS\SYSKF32.EXE /s
O4 - HKLM\..\RunServices: [SDKXM.EXE] C:\WINDOWS\SDKXM.EXE /s
O4 - HKLM\..\RunServices: [SDKUF32.EXE] C:\WINDOWS\SDKUF32.EXE /s
O4 - HKLM\..\RunServices: [APIRH.EXE] C:\WINDOWS\APIRH.EXE /s
O4 - HKLM\..\RunServices: [NTFP32.EXE] C:\WINDOWS\SYSTEM\NTFP32.EXE /s
O4 - HKLM\..\RunServices: [APIIH.EXE] C:\WINDOWS\APIIH.EXE /s
O4 - HKLM\..\RunServices: [APPRU.EXE] C:\WINDOWS\APPRU.EXE /s
O4 - HKLM\..\RunServices: [ATLER32.EXE] C:\WINDOWS\SYSTEM\ATLER32.EXE /s
O4 - HKLM\..\RunServices: [JAVAVK.EXE] C:\WINDOWS\SYSTEM\JAVAVK.EXE /s
O4 - HKLM\..\RunServices: [ADDNR32.EXE] C:\WINDOWS\ADDNR32.EXE /s
O4 - HKLM\..\RunServices: [SYSGD32.EXE] C:\WINDOWS\SYSTEM\SYSGD32.EXE /s
O4 - HKLM\..\RunServices: [ADDDS32.EXE] C:\WINDOWS\SYSTEM\ADDDS32.EXE /s
O4 - HKLM\..\RunServices: [NETBZ32.EXE] C:\WINDOWS\NETBZ32.EXE /s
O4 - HKLM\..\RunServices: [CRZS.EXE] C:\WINDOWS\SYSTEM\CRZS.EXE /s
O4 - HKLM\..\RunServices: [ADDLS.EXE] C:\WINDOWS\SYSTEM\ADDLS.EXE /s
O4 - HKLM\..\RunServices: [MFCDL.EXE] C:\WINDOWS\SYSTEM\MFCDL.EXE /s
O4 - HKLM\..\RunServices: [NTEU32.EXE] C:\WINDOWS\NTEU32.EXE /s
O4 - HKLM\..\RunServices: [IEEW32.EXE] C:\WINDOWS\IEEW32.EXE /s
O4 - HKLM\..\RunServices: [IEAD32.EXE] C:\WINDOWS\SYSTEM\IEAD32.EXE /s
O4 - HKLM\..\RunServices: [APPWF32.EXE] C:\WINDOWS\SYSTEM\APPWF32.EXE /s
O4 - HKLM\..\RunServices: [APIZN.EXE] C:\WINDOWS\SYSTEM\APIZN.EXE /s
O4 - HKLM\..\RunServices: [CRVW.EXE] C:\WINDOWS\CRVW.EXE /s
O4 - HKLM\..\RunServices: [D3LA32.EXE] C:\WINDOWS\SYSTEM\D3LA32.EXE /s
O4 - HKLM\..\RunServices: [SYSBJ32.EXE] C:\WINDOWS\SYSTEM\SYSBJ32.EXE /s
O4 - HKLM\..\RunServices: [MSSC.EXE] C:\WINDOWS\MSSC.EXE /s
O4 - HKLM\..\RunServices: [APIVK.EXE] C:\WINDOWS\APIVK.EXE /s
O4 - HKLM\..\RunServices: [APPIP.EXE] C:\WINDOWS\SYSTEM\APPIP.EXE /s
O4 - HKLM\..\RunServices: [APIQB32.EXE] C:\WINDOWS\APIQB32.EXE /s
O4 - HKLM\..\RunServices: [WINKI.EXE] C:\WINDOWS\SYSTEM\WINKI.EXE /s
O4 - HKLM\..\RunServices: [MFCOK.EXE] C:\WINDOWS\MFCOK.EXE /s
O4 - HKLM\..\RunServices: [ADDNQ32.EXE] C:\WINDOWS\SYSTEM\ADDNQ32.EXE /s
O4 - HKLM\..\RunServices: [IPOS32.EXE] C:\WINDOWS\SYSTEM\IPOS32.EXE /s
O4 - HKLM\..\RunServices: [ADDCD32.EXE] C:\WINDOWS\ADDCD32.EXE /s
O4 - HKLM\..\RunServices: [CRXX32.EXE] C:\WINDOWS\CRXX32.EXE /s
O4 - HKLM\..\RunServices: [WINYE.EXE] C:\WINDOWS\SYSTEM\WINYE.EXE /s
O4 - HKLM\..\RunServices: [MFCXE.EXE] C:\WINDOWS\SYSTEM\MFCXE.EXE /s
O4 - HKLM\..\RunServices: [IPHA32.EXE] C:\WINDOWS\IPHA32.EXE /s
O4 - HKLM\..\RunServices: [CRHO.EXE] C:\WINDOWS\CRHO.EXE /s
O4 - HKLM\..\RunServices: [IEID32.EXE] C:\WINDOWS\SYSTEM\IEID32.EXE /s
O4 - HKLM\..\RunServices: [MSRX.EXE] C:\WINDOWS\MSRX.EXE /s
O4 - HKLM\..\RunServices: [MSOP.EXE] C:\WINDOWS\MSOP.EXE /s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAMME\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: Office-Start.lnk = C:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft-Indexerstellung.lnk = C:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM\E_SRCV03.EXE
O4 - Startup: Verknüpfung mit Printkey.exe.lnk = C:\Tools\Printkey\Printkey.exe
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\PROGRAMME\ICQTOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\SYSTEM\SHDOCVW.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

chaosman 30.05.2005 20:08

@alfred_nuesse

system und IE updaten,
dieser cleaner laufen lassen
http://www.derbilk.de/404.html
danach neues HJT logfile posten


chaosman


Alle Zeitangaben in WEZ +1. Es ist jetzt 05:17 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19