|
Wir hatten auch Trojaner Nach der Entfernung einiger Trojaner, unter anderem StartPage, hab ich hier mal meinen Scan zum Durchschauen. Ich muss dazu sagen, dass mein PC nimmer im abgesicherten Modus startet. Er hängt sich mit weißem blinkendem Balken oben links auf. Logfile of HijackThis v1.99.1 Scan saved at 11:47:35, on 16.06.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\mHotkey.exe C:\WINDOWS\Dit.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe C:\Programme\Home Cinema\PowerCinema\PCMService.exe C:\Programme\Netropa\Multimedia Keyboard\MMKeybd.exe C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe C:\PROGRA~1\0190WA~1\WARN0190.EXE C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Programme\Java\jre1.5.0_02\bin\jusched.exe C:\Programme\FSC\Wireless Wheel Mouse\MOUSE32A.EXE C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE C:\Programme\Microsoft Money\System\reminder.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\Programme\Kodak\Kodak EasyShare Software\bin\EasyShare.exe C:\WINDOWS\DitExp.exe C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe C:\Programme\Netropa\Multimedia Keyboard\nhksrv.exe C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe C:\Programme\Netropa\Multimedia Keyboard\TrayMon.exe C:\Programme\Netropa\Onscreen Display\OSD.exe C:\Programme\Netropa\InetKb\Inetkb.exe C:\Programme\AntiVirenKit 2005\AVKService.exe C:\Programme\AntiVirenKit 2005\AVKWCtl.exe C:\WINDOWS\system32\drivers\KodakCCS.exe C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\fxssvc.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\Programme\AOL 9.0\waol.exe C:\Programme\AOL 9.0\shellmon.exe C:\Programme\Gemeinsame Dateien\Aol\aoltpspd.exe C:\DOKUME~1\ANJAUN~1\LOKALE~1\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://my.ebay.de/ws/eBayISAPI.dll?MyeBay&LogUID=wechhierkommich&CurrentPage=MyeBaySelling&ssPageName=STRK:ME:LNLK R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.antiviruslab.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [PCMService] "C:\Programme\Home Cinema\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Programme\Netropa\Multimedia Keyboard\MMKeybd.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [LWBMOUSE] C:\Programme\FSC\Wireless Wheel Mouse\MOUSE32A.EXE O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe O4 - HKLM\..\Run: [eBayToolbar] C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [AVK Mail Checker] "C:\Programme\Gemeinsame Dateien\G DATA\AVKMail\AVKPOP.EXE" O4 - HKLM\..\Run: [AOLDialer] C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [0190 Warner] C:\PROGRA~1\0190WA~1\WARN0190.EXE O4 - HKCU\..\Run: [Reminder] C:\Programme\Microsoft Money\System\reminder.exe O4 - HKCU\..\Run: [AVKBar] "C:\Programme\AntiVirenKit 2005\AVKBar.exe" O4 - Startup: Registration-InstantCopy.lnk = C:\Programme\Pinnacle\Shared Files\InstantCDDVD\Pixie\RegTool.exe O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programme\Kodak\Kodak EasyShare Software\bin\EasyShare.exe O4 - Global Startup: Kodak software updater.lnk = C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: Fortune Bingo by pogo - h**p://game1.pogo.com/applet-6.1.4.29/superbingo/superbingo-ob-assets.cab O16 - DPF: Word Whomp Whackdown by pogo - h**tp://game1.pogo.com/applet-6.1.2.25/whackdown/whackdown-ob-assets.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - h**p://aolcc.aol.de/computercheckup/qdiagcc.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://h**p://software-dl.real.com/0...dxIE601_de.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - h**p://game17.zylomgames.com/activex/zylomgamesplayer.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - h**p://game12.zylomgames.com/activex/zylomloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{14DA5F98-88AE-4C92-893E-1DF487C34B76}: NameServer = 205.188.146.145 O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Programme\Gemeinsame Dateien\AOL\ACS\AOLAcsd.exe O23 - Service: AOL Privacy Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\GEMEIN~1\aol\AOLPRI~1\\aolserv.exe O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Programme\AntiVirenKit 2005\AVKService.exe O23 - Service: AVK Wächter (AVKWCtl) - Unknown owner - C:\Programme\AntiVirenKit 2005\AVKWCtl.exe O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Ereignisprotokoll-Überwachung (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Programme\Netropa\Multimedia Keyboard\nhksrv.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe |
Hier noch eben die Trojaner, die bisher auf dem System waren: Trojan.StartPage.751 Trojan.Clicker.Delf.CG Dropped:Trojan.Autoit.E Trojan.Dialer.Star.A Trojan-Spy.HTML.Fraud.gen Virenprogramm teilt mit, dass der PC nun gesäubert ist. Aber wer weiß wo die sich verstecken? |
|
So, hat ein bisschen gedauert, aber nun fertig, schau dir das mal an: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Funde für "infected" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thu Jun 16 13:59:09 2005 => System found infected with CWS.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken. Thu Jun 16 13:59:39 2005 => System found infected with iSearch Spyware/Adware (patch.exe)! Action taken: No Action Taken. Thu Jun 16 15:32:09 2005 => Total Disinfected Files: 0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Funde für "tagged" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thu Jun 16 13:57:06 2005 => File C:\WINDOWS\Dit.exe tagged as not-a-virus:Garbage.Win32.CustomIcons. No Action Taken. Thu Jun 16 13:57:12 2005 => File C:\WINDOWS\DitExp.exe tagged as not-a-virus:Garbage.Win32.CustomIcons. No Action Taken. Thu Jun 16 13:57:23 2005 => File C:\WINDOWS\Dit.exe tagged as not-a-virus:Garbage.Win32.CustomIcons. No Action Taken. Thu Jun 16 14:00:00 2005 => File C:\WINDOWS\DitExp.exe tagged as not-a-virus:Garbage.Win32.CustomIcons. No Action Taken. Thu Jun 16 14:06:15 2005 => File C:\DOKUME~1\ANJAUN~1\LOKALE~1\Temp\Temporäres Verzeichnis 1 für setup_freeway_2_2.zip\setup_freeway_2_2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 14:24:47 2005 => File C:\Dokumente und Einstellungen\Anja und Michael\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für setup_freeway_2_2.zip\setup_freeway_2_2.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 14:36:55 2005 => File C:\Programme\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 14:45:10 2005 => Scanning File C:\Programme\Kodak\Kodak EasyShare Software\bin\Tagged.chm Thu Jun 16 14:45:35 2005 => File C:\Programme\LexmarkX73\RemoveX73.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 14:45:35 2005 => File C:\Programme\LexmarkX73\SETUPX73PART2.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 14:45:49 2005 => File C:\Programme\LexmarkX73\X73Twain.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu Jun 16 15:04:13 2005 => File C:\WINDOWS\DitExp.exe tagged as not-a-virus:Garbage.Win32.CustomIcons. No Action Taken. Thu Jun 16 15:27:48 2005 => File D:\Tools\AOL\AOLSetup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Statistiken: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thu Jun 16 15:32:09 2005 => Total Virus(es) Found: 15 Thu Jun 16 15:32:09 2005 => Total Errors: 261 Thu Jun 16 15:32:09 2005 => Time Elapsed: 01:35:18 Thu Jun 16 15:32:09 2005 => Total Objects Scanned: 123958 Thu Jun 16 13:56:15 2005 => Virus Database Date: 2005/06/16 Thu Jun 16 15:32:09 2005 => Virus Database Date: 2005/06/16 Thu Jun 16 15:32:21 2005 => Virus Database Date: 2005/06/16 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~ © Haui ;-) ~~~~~~~ ~~~~~~~ Dank an Cidre ~~~~~~~ Vielen Dank auch von mir |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 11:26 Uhr. |
Copyright ©2000-2025, Trojaner-Board